[
https://issues.apache.org/jira/browse/TINKERPOP-3281?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123555#comment-18123555
]
ASF GitHub Bot commented on TINKERPOP-3281:
-------------------------------------------
codecov-commenter commented on PR #3703:
URL: https://github.com/apache/tinkerpop/pull/3703#issuecomment-6004133108
##
[Codecov](https://app.codecov.io/gh/apache/tinkerpop/pull/3703?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 80.15%. Comparing base
([`a28cd1f`](https://app.codecov.io/gh/apache/tinkerpop/commit/a28cd1f2f1f10c140030a56de44c5c6c045af5f0?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache))
to head
([`ea45b85`](https://app.codecov.io/gh/apache/tinkerpop/commit/ea45b858c11d10f1610a98ccc175edfa6867b94c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 659 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #3703 +/- ##
============================================
+ Coverage 76.35% 80.15% +3.79%
============================================
Files 1012 32 -980
Lines 60341 6945 -53396
Branches 7075 0 -7075
============================================
- Hits 46076 5567 -40509
+ Misses 11548 1050 -10498
+ Partials 2717 328 -2389
```
</details>
[:umbrella: View full report in Codecov by
Harness](https://app.codecov.io/gh/apache/tinkerpop/pull/3703?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it
here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test
Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests,
report on failures, and find test suite problems.
- :package: [JS Bundle
Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save
yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
> GraphBinary deserializer unbounded pre-allocation from length prefixes
> ----------------------------------------------------------------------
>
> Key: TINKERPOP-3281
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3281
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Priority: Major
> Fix For: 3.7.7, 3.8.2
>
>
> GraphBinary value types size a heap allocation (or bound a read loop) from a
> 4-byte length/count prefix before the payload is read or checked against the
> bytes actually remaining. Because GraphBinary is deserialized
> pre-authentication on the default wire path, a tiny malformed frame (~6-21
> bytes) can declare a multi-hundred-megabyte to multi-gigabyte allocation and
> drive Gremlin Server to OutOfMemoryError. maxContentLength bounds the frame,
> not a single declared length, and the binary decoder catches only
> SerializationException, so the OOM escapes. The surface is symmetric: a
> malicious or on-path server can OOM a connecting driver the same way. The
> same shape recurs across String, Collection (list/set), Map, BigInteger,
> InetAddress, ByteBuffer, Bytecode, P, Tree, graph and BulkSet.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
