RockteMQ-AI commented on issue #11180:
URL: https://github.com/apache/rocketmq/issues/11180#issuecomment-5741705441
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The reported issue has been verified against the current codebase.
**Root Cause:**
In `PopCheckPoint.indexOfAck(long ackOffset)` at line 186, the `long`
difference between `ackOffset` and `startOffset` is narrowed to `int` before
searching in `queueOffsetDiff`:
```java
return queueOffsetDiff.indexOf((int) (ackOffset - startOffset));
```
This cast truncates the upper 32 bits, allowing an out-of-range ACK offset
whose difference is congruent to a valid queue-offset difference modulo `2^32`
to be incorrectly accepted.
**Impact:**
- `PopBufferMergeService` (lines 573, 581) and `PopReviveService` (lines
421, 450) trust the return value
- A wrapped match can mark the wrong checkpoint bit, causing incorrect
message acknowledgment
- Potential data integrity issues: messages lost or duplicated in POP
consumption
**Severity:** High — affects message reliability in POP consumption mode
**Suggested Fix:**
Calculate the difference as `long`, reject values outside `[0,
Integer.MAX_VALUE]`, and only then narrow to `int`:
```java
public int indexOfAck(long ackOffset) {
if (ackOffset < startOffset) {
return -1;
}
long diff = ackOffset - startOffset;
// old version of checkpoint
if (queueOffsetDiff == null || queueOffsetDiff.isEmpty()) {
if (diff < num) {
return (int) diff;
}
return -1;
}
// new version: validate range before narrowing
if (diff > Integer.MAX_VALUE) {
return -1;
}
return queueOffsetDiff.indexOf((int) diff);
}
```
Add regression tests for both normal ACK and wrapped ACK scenarios.
An automated fix proposal can be generated. Reply `/approve` to proceed with
PR generation.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
