GumpacG opened a new pull request, #3610:
URL: https://github.com/apache/tinkerpop/pull/3610
GraphBinary sized heap allocations from an unvalidated 4-byte length prefix
before reading the payload, so a tiny
pre-auth frame (~6-21 bytes) could demand gigabytes and OOM Gremlin Server
or a connecting driver.
## What changed
- Validate each length/count against the bytes actually remaining before it
sizes an allocation or bounds a loop;
reject negative or oversized with `IOException`.
- Cap eager pre-sizing of growable collections/maps (grow on demand instead).
- Reject truncated length prefixes and negative `BulkSet` bulk values.
- Covers `String`, `ByteBuffer`, `BigInteger`, `InetAddress`, list, set,
map, `Tree`, `BulkSet`, `Bytecode`, `P`
and graph. Well-formed messages are unaffected.
## Testing
`GraphBinaryLengthPrefixTest` (rejection + large round-trip cases); full
GraphBinary compatibility suite green.
<br>
See: https://issues.apache.org/jira/browse/TINKERPOP-3281
Assisted-by: Kiro: Claude Opus 4.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
