ubeddulla opened a new pull request, #3404:
URL: https://github.com/apache/brpc/pull/3404
The simple-string ('+') and error ('-') branch of
RedisReply::ConsumePartialIOBuf never bounds the payload length against
redis_max_allocation_size, unlike the bulk-string ('$') and array ('*')
branches in the same function which both cap it. A server returning a simple
string of 2^31 bytes or more truncates the length into the signed int _length,
and c_str()/data()/Print()/SerializeTo() then take the small-string path for
the negative value and read past the 16-byte inline buffer. Cap it the same way
the sibling branches already do, and add a regression test next to the existing
bulk-string and array limit checks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
