ubeddulla opened a new pull request, #3381: URL: https://github.com/apache/brpc/pull/3381
### What problem does this PR solve? Issue Number: resolve N/A Problem Summary: The text-protocol `MysqlReply::Field::Parse` in `src/brpc/policy/mysql/mysql_reply.cpp` reads a length-encoded field length from the server and calls `buf.cutn(&str, len)` without checking `len` against the remaining buffer. `IOBuf::cutn` clamps to what is available, so a field whose length-encoded prefix claims more bytes than remain makes the string branch allocate `len` arena bytes, copy only the fewer bytes actually present, and then publish `_data.str` as a StringPiece of `len` bytes. The tail is uninitialized arena memory that gets read back by the caller, and the short read desyncs the packet stream. A malicious or compromised MySQL server can trigger it through any text result set. Every sibling length-encoded read in the same file (the binary `Field::Parse`, `Column::Parse`, the auth-plugin path, `ParseBinaryTime`/`ParseBinaryDataTime`) already rejects `len > buf.size()`; only this text overload was missing the check. ### What is changed and the side effects? Changed: Added the same `len > buf.size()` guard before the `cutn` in the text `Field::Parse`, returning `PARSE_ERROR_ABSOLUTELY_WRONG` on an oversized length. Valid result sets are unaffected since a well-formed field always fits in the buffer. Side effects: - Performance effects: none, a single size comparison per field. - Breaking backward compatibility: none. --- ### Check List: - Please make sure your changes are compilable. - When providing us with a new feature, it is best to add related tests. - Please follow [Contributor Covenant Code of Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
