Iryna-Kahamlyk opened a new pull request, #3703: URL: https://github.com/apache/tinkerpop/pull/3703
JIRA: https://issues.apache.org/jira/browse/TINKERPOP-3281 GraphBinary sized heap allocations from an unvalidated 4-byte length prefix before reading the payload, so a tiny pre-auth frame (~6–21 bytes) could request gigabytes of memory and OOM Gremlin Server or a connecting driver. **Changes** This was already fixed on 3.7-dev in https://github.com/apache/tinkerpop/pull/3610. However, the same fix does not work on master. A shared `readSizePrefix()` in `SimpleTypeSerializer` that unconditionally calls `buffer.readableBytes()` would break the active streaming driver path. Instead, validation is split based on how the prefix is used, with `readableBytes()` checked only when the buffer can report it. The following helpers were added: * `readByteLength()` — fixed-size byte allocations (String, BigInteger, Binary/ByteBuffer); rejects negative values, enforces an explicit cap, and checks `readableBytes()` when known. * `readElementCount()` — growable containers (List/Set/Map/Tree/Graph); rejects negative values and checks `readableBytes()` when known, with no explicit cap. * `readFixedArrayCount()` — fixed arrays (P arguments); validated like byte lengths since the array cannot grow incrementally. * `cappedInitialCapacity()` — caps speculative ArrayList/HashMap pre-sizing. These are applied across StringSerializer, BigIntegerSerializer, BinarySerializer, CollectionSerializer(List/Set), MapSerializer, TreeSerializer, GraphSerializer, ListSerializer, and PSerializer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
