SEPURI-SAI-KRISHNA opened a new pull request, #22755:
URL: https://github.com/apache/kafka/pull/22755
ListDeserializer.deserialize only treated a -1 return from
DataInputStream.read(byte[]) as a truncated stream, but read may return a
partial count without reaching EOF. The entrySize bounds check compares
against data.length (the whole buffer), not the bytes remaining, so a
corrupted payload can declare an entry size that passes the check yet
exceeds the remaining bytes. When that happens the entry buffer is left
zero-padded and handed to the inner deserializer with no error, silently
producing a corrupted value instead of the intended
SerializationException("End of the stream was reached prematurely").
Switch to DataInputStream.readFully, which throws EOFException when the
buffer cannot be filled, and map it to the existing SerializationException.
Behavior is unchanged for well-formed input.
Testing: added ListDeserializerTest.shouldThrowOnEntryTruncatedMidStream,
which encodes a VARIABLE_SIZE list declaring a 10-byte entry but supplying
only 5 payload bytes. The test fails without the fix (no exception thrown,
corrupted entry returned) and passes with it. Full ListDeserializerTest
suite, checkstyle, and spotless pass locally.
Co-Authored-By: Claude Fable 5
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
