zjncs opened a new pull request, #11066:
URL: https://github.com/apache/rocketmq/pull/11066
### Motivation
`MQVersion.getVersionDesc(int)` and `value2Version(int)` guard only the
upper bound:
```java
public static Version value2Version(int value) {
Version[] versions = VERSION_VALUES;
int length = versions.length;
if (value >= length) {
return versions[length - 1];
}
return versions[value]; // value < 0 ->
ArrayIndexOutOfBoundsException
}
```
A negative value indexes `VERSION_VALUES[-1]` and throws
`ArrayIndexOutOfBoundsException`.
This is reachable from the wire: `RocketMQSerializable` decodes the remoting
header version as a **signed short** (`headerBuffer.readShort()`), so a peer
sending version bytes `0xFFFF` produces `value == -1`. The namesrv
broker-registration path (`DefaultRequestProcessor` →
`MQVersion.value2Version(request.getVersion())`) and
`getVersionDesc(conn.getVersion())` in the tools/broker connection commands
both consume that wire-controlled value, and crash with AIOOBE instead of
answering cleanly.
### Modifications
Extend both guards to `value < 0 || value >= length`, falling back to the
last entry — consistent with the existing "unknown → HIGHER_VERSION" semantics
already pinned by `testValue2Version_HigherVersion`.
### Verification
Fail-before (new test `testNegativeVersionFallsBackToHigherVersion`, run
against the unpatched code):
```
Tests run: 2, Failures: 0, Errors: 1 -- MQVersionTest
java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length
613
```
Pass-after:
```
Tests run: 5, Failures: 0, Errors: 0, Skipped: 0 -- MQVersionTest
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
