anton-vinogradov opened a new pull request, #13326:
URL: https://github.com/apache/ignite/pull/13326

   In `CompressedMessageSerializer.readFrom()`, state 2 reads the next 
compressed chunk. `DirectByteBufferStream.readByteArray()` returns `null` (with 
`lastFinished == true`) when the wire contains the null-array marker (length 
`-1`). A well-behaved sender never writes `null` at this position (`writeTo()` 
only enters state 2 with a non-null chunk), but a corrupted stream or a 
malicious/incompatible peer can produce it: the `-1` length is accepted, the 
null branch does not advance the reader state, and the `while (true)` loop 
re-executes state 2 forever — the grid-nio worker thread spins at 100% CPU and 
its stripe stops processing messages, effectively degrading the whole node.
   
   The fix treats a null chunk at this protocol position as a protocol 
violation: `IgniteException` with a descriptive message is thrown instead of 
silently looping. The exception propagates out of message decoding and the 
connection is closed.
   
   Covered by a unit test that feeds the reader a buffer with the null-array 
marker at the chunk position and asserts the exception is thrown.
   
   Note: this file is also touched by #13325 (IGNITE-28853, direct-buffer 
accumulator rework of the same method). The overlap is trivial (`case 2` is 
structurally identical in both versions), so the PRs can be merged in any 
order; whichever lands second resolves a one-hunk conflict.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to