ubeddulla opened a new pull request, #3402: URL: https://github.com/apache/brpc/pull/3402
### What problem does this PR solve? Issue Number: resolve Problem Summary: `popCollectionId()` and `popManifest()` in `src/brpc/couchbase.cpp` size the value section with unsigned arithmetic: `header.total_body_length - header.extras_length - header.key_length`. All three fields come straight from the server's response header and nothing cross-checks them, so a reply where `extras_length + key_length` exceeds `total_body_length` wraps the subtraction close to `SIZE_MAX`. `IOBuf::cutn()` clamps to what is available, so the whole remaining pipelined buffer gets swallowed: `popManifest()` hands those bytes back to the caller as the collection manifest, `popCollectionId()` folds them into the error string, and either way the response stream on that connection is out of sync from then on. The sibling parsers in the same file (`popGet`, `popStore`, `popCounter`, `popVersion`) already compute this as a signed `int` and bail out when it is negative; only these two collection parsers were written with `size_t` and no check. Reproduced against a 24-byte header with `total_body_length=0`, `extras_length=1` followed by 64 bytes of the next response: `popManifest()` returns true with a computed size of 18446744073709551615, copies 63 bytes of the following response into the manifest string and leaves the buffer empty. With this change it returns false and the buffer is untouched. ### What is changed and the side effects? Changed: Both functions now use the same signed computation and `< 0` rejection as their siblings, done before `pop_front()` so a malformed reply does not consume anything. Added a regression test to `test/brpc_couchbase_unittest.cpp`. Side effects: - Performance effects: none. - Breaking backward compatibility: no, well-formed responses parse exactly as before. --- ### Check List: - Please make sure your changes are compilable. - When providing us with a new feature, it is best to add related tests. - Please follow [Contributor Covenant Code of Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
