Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RelpParser.java does not sanity check TxId / Command / Length sizes #60

Open
StrongestNumber9 opened this issue Oct 5, 2023 · 2 comments
Assignees

Comments

@StrongestNumber9
Copy link
Contributor

RelpConnection relpConnection = new RelpConnection();
relpConnection.connect("127.0.0.1", 1236);

causes

java.nio.BufferOverflowException
	at java.base/java.nio.Buffer.nextPutIndex(Buffer.java:722)
	at java.base/java.nio.DirectByteBuffer.put(DirectByteBuffer.java:359)
	at com.teragrep.rlp_01.RelpParser.parse(RelpParser.java:135)
	at com.teragrep.rlp_01.RelpConnection.readAcks(RelpConnection.java:257)
	at com.teragrep.rlp_01.RelpConnection.sendBatch(RelpConnection.java:235)
	at com.teragrep.rlp_01.RelpConnection.connect(RelpConnection.java:159)
	at com.teragrep.rlp_01.ConnectionTest.testInvalidReply(ConnectionTest.java:64)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)

when server answers just

"200 OK\ncommands=syslog\n";

Note that it is missing the header frame completely

@StrongestNumber9 StrongestNumber9 changed the title Server sending invalid commands can cause BufferOverflowExceptions RelpParser.java does not sanity check TxId / Command / Length sizes Oct 11, 2023
@StrongestNumber9
Copy link
Contributor Author

Server replying the following will also crash the parser, whatever comes after those is irrelevant

0000000000000000000000000001 rsp 0
1 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 0
1 rsp 2000000000000000000

@StrongestNumber9
Copy link
Contributor Author

Their max size is predeterminated

private final ByteBuffer txnIdBuffer = ByteBuffer.allocateDirect(String.valueOf(TxID.MAX_ID).length());

private final ByteBuffer commandBuffer = ByteBuffer.allocateDirect(MAX_COMMAND_LENGTH);

private final ByteBuffer lengthBuffer = ByteBuffer.allocateDirect(String.valueOf(Integer.MAX_VALUE).length());

But they are not sanity checked at any point

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants