wwbmmm opened a new pull request, #3450:
URL: https://github.com/apache/brpc/pull/3450
### What problem does this PR solve?
Issue Number: null
Problem Summary:
A malformed mcpack2/compack request that contains a string field with a
zero value_size crashes the server. In `UnparsedValue::as_string()`,
`_size` (the string field's value_size, taken directly from the input)
is used in `out->resize(_size - 1)` without being validated first. When
value_size is 0, `_size - 1` underflows to SIZE_MAX, `resize()` throws
`std::length_error`, and since the exception is not caught anywhere on
the request parsing path the whole process aborts. This is reachable
from `UbrpcAdaptor::ParseNsheadMeta` and
`UbrpcAdaptor::ParseRequestFromIOBuf` for servers wired with the
nshead + ubrpc mcpack2 adaptor.
### What is changed and the side effects?
Changed:
- `src/mcpack2pb/parser.cpp`: reject string fields whose value_size is 0
in `UnparsedValue::as_string()` by marking the input stream bad and
returning, instead of underflowing and throwing.
- `test/brpc_mcpack2pb_unittest.cpp`: add unit tests covering the
zero-size string field case and a normal string field parse.
Side effects:
- Performance effects: none (one extra comparison per string field).
- Breaking backward compatibility: none. Well-formed input is parsed
exactly as before; only previously-crashing malformed input now fails
gracefully.
---
### Check List:
- Please make sure your changes are compilable.
- When providing us with a new feature, it is best to add related tests.
- Please follow [Contributor Covenant Code of
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
