You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@eventmesh.apache.org by "qqeasonchen (via GitHub)" <gi...@apache.org> on 2026/09/09 02:15:29 UTC
[PR] fix(#5361): FrameLimits — enforce wire bounds at encode AND decode (no-alloc rejects) (eventmesh)
qqeasonchen opened a new pull request, #5372:
URL: https://github.com/apache/eventmesh/pull/5372
## What this PR does
Closes #5361 — Phase 1 of the production-HA plan (#5354), acceptance **A3**: the frame codec enforces wire bounds at BOTH boundaries and rejects malformed input **without OOM**.
### 1. The gap this fixes
The codec accepted whatever sizes the header advertised. A hostile frame declaring `dataLen = 2^31-1` made the decoder allocate that much memory before failing on the truncated body (**OOM instead of a clean reject**); truncated buffers escaped as `BufferUnderflowException`.
### 2. New `FrameLimits` (`eventmesh-common/wire`)
| Limit | Value |
|---|---|
| `MAX_FRAME_BYTES` | 16 MiB |
| `MAX_DATA_BYTES` | 8 MiB |
| `MAX_ATTRIBUTES` | 64 |
| `MAX_ATTR_NAME_BYTES` | 256 B |
| `MAX_ATTR_VALUE_BYTES` | 4 KiB |
### 3. Boundary enforcement
- **Encode**: attribute count / data length / attr name+value lengths / total encoded size all fail fast — a producer cannot build an oversized frame.
- **Decode**: advertised `keyCount`/`dataLen` rejected **before any allocation**; every buffer read (attribute length prefixes, string bodies, data bulk-get) guarded. `decode` is now **total**: any byte sequence either decodes or throws `IllegalArgumentException` — never underflow, never over-allocation.
### 4. Tests (new `FrameLimitsTest`, 8 cases)
- 4 encode-bound rejects + **at-the-limit acceptance** (boundary is `>`)
- Hostile `dataLen=Integer.MAX_VALUE` on a 64-byte buffer → clean `IllegalArgumentException`, no allocation
- Hostile `keyCount`; `dataLen` beyond provided buffer
- **Deterministic 20,000-iteration byte-mutation fuzz** — every mutant either decodes or throws `IllegalArgumentException` (the fuzz found and drove the fix for both underflow escapes during development)
### Verification (local, Temurin 21.0.11)
```
:eventmesh-common:test + checkstyle (maxWarnings=0) BUILD SUCCESSFUL
downstream: runtime + architecture-guard + storage-api tests BUILD SUCCESSFUL
```
### Relations
- Closes #5361 (Phase 1, P0) — completes Phase 1 alongside #5359 (`b3f9f75b4`) and #5360 (`017843ef1`)
- Parent: #5354 · Plan: `docs/architecture-review/production-ha-plan.md` (PR #5366)
- Builds on the #5357 immutable frame (merged `7ac0ab824`)
Co-authored-by: qqeasonchen <qq...@gmail.com>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@eventmesh.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: dev-help@eventmesh.apache.org
Re: [PR] fix(#5361): FrameLimits — enforce wire bounds at encode AND decode (no-alloc rejects) (eventmesh)
Posted by "qqeasonchen (via GitHub)" <gi...@apache.org>.
qqeasonchen merged PR #5372:
URL: https://github.com/apache/eventmesh/pull/5372
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@eventmesh.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: dev-help@eventmesh.apache.org