ubeddulla opened a new pull request, #3402:
URL: https://github.com/apache/brpc/pull/3402

   ### What problem does this PR solve?
   
   Issue Number: resolve 
   
   Problem Summary:
   
   `popCollectionId()` and `popManifest()` in `src/brpc/couchbase.cpp` size the 
value section with unsigned arithmetic: `header.total_body_length - 
header.extras_length - header.key_length`. All three fields come straight from 
the server's response header and nothing cross-checks them, so a reply where 
`extras_length + key_length` exceeds `total_body_length` wraps the subtraction 
close to `SIZE_MAX`. `IOBuf::cutn()` clamps to what is available, so the whole 
remaining pipelined buffer gets swallowed: `popManifest()` hands those bytes 
back to the caller as the collection manifest, `popCollectionId()` folds them 
into the error string, and either way the response stream on that connection is 
out of sync from then on. The sibling parsers in the same file (`popGet`, 
`popStore`, `popCounter`, `popVersion`) already compute this as a signed `int` 
and bail out when it is negative; only these two collection parsers were 
written with `size_t` and no check.
   
   Reproduced against a 24-byte header with `total_body_length=0`, 
`extras_length=1` followed by 64 bytes of the next response: `popManifest()` 
returns true with a computed size of 18446744073709551615, copies 63 bytes of 
the following response into the manifest string and leaves the buffer empty. 
With this change it returns false and the buffer is untouched.
   
   ### What is changed and the side effects?
   
   Changed:
   
   Both functions now use the same signed computation and `< 0` rejection as 
their siblings, done before `pop_front()` so a malformed reply does not consume 
anything. Added a regression test to `test/brpc_couchbase_unittest.cpp`.
   
   Side effects:
   - Performance effects: none.
   
   - Breaking backward compatibility: no, well-formed responses parse exactly 
as before.
   
   ---
   ### Check List:
   - Please make sure your changes are compilable.
   - When providing us with a new feature, it is best to add related tests.
   - Please follow [Contributor Covenant Code of 
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to