[
https://issues.apache.org/jira/browse/IGNITE-13635?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pavel Tupitsyn updated IGNITE-13635:
------------------------------------
Description:
{{PlatformOutputStreamImpl.unsafeEnsure}} causes integer overflow, then passes
a negative value to {{PlatformCallbackGateway.memoryReallocate}} from there it
is passed to {{Marshal.ReAllocHGlobal}}, which throws an OutOfMemoryException.
Reproducer:
{code}
var val = new byte[100_000_000];
var ignite = Ignition.Start();
var cache = ignite.CreateCache<int, byte[]>("c");
for (int i = 0; i < 30; i++) // ~3GB of cache data
cache[i] = val;
cache.Query(new ScanQuery<int, byte[]>()).GetAll();
{code}
was:{{PlatformOutputStreamImpl.unsafeEnsure}} causes integer overflow, then
passes a negative value to {{PlatformCallbackGateway.memoryReallocate}} from
there it is passed to {{Marshal.ReAllocHGlobal}}, which throws an
OutOfMemoryException.
> .NET: OOM due to integer overflow in PlatformOutputStream
> ---------------------------------------------------------
>
> Key: IGNITE-13635
> URL: https://issues.apache.org/jira/browse/IGNITE-13635
> Project: Ignite
> Issue Type: Bug
> Components: platforms
> Affects Versions: 1.4, 2.9
> Reporter: Pavel Tupitsyn
> Assignee: Pavel Tupitsyn
> Priority: Major
> Labels: .NET
> Fix For: 2.10, 2.9.1
>
>
> {{PlatformOutputStreamImpl.unsafeEnsure}} causes integer overflow, then
> passes a negative value to {{PlatformCallbackGateway.memoryReallocate}} from
> there it is passed to {{Marshal.ReAllocHGlobal}}, which throws an
> OutOfMemoryException.
> Reproducer:
> {code}
> var val = new byte[100_000_000];
> var ignite = Ignition.Start();
> var cache = ignite.CreateCache<int, byte[]>("c");
> for (int i = 0; i < 30; i++) // ~3GB of cache data
> cache[i] = val;
> cache.Query(new ScanQuery<int, byte[]>()).GetAll();
> {code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
