[jira] [Created] (NIFI-15690) CacheRequestDecoder.readHeader() leaks ByteBuf - should use skipBytes instead of readBytes

["Daniel Chaffelson (Jira)" <ji...@apache.org>]

Daniel Chaffelson created NIFI-15690:
----------------------------------------

             Summary: CacheRequestDecoder.readHeader() leaks ByteBuf - should use skipBytes instead of readBytes
                 Key: NIFI-15690
                 URL: https://issues.apache.org/jira/browse/NIFI-15690
             Project: Apache NiFi
          Issue Type: Bug
    Affects Versions: 2.7.2, 1.28.1
            Reporter: Daniel Chaffelson


The readHeader() method in CacheRequestDecoder allocates a new ByteBuf that is never released:

{code:java}
private void readHeader(final ByteBuf byteBuf, final SocketAddress remoteAddress) {
    if (byteBuf.readableBytes() >= HEADER_LENGTH) {
        byteBuf.readBytes(HEADER_LENGTH);  // Creates new ByteBuf, never released
        headerReceived.getAndSet(true);
        log.debug("Header Received [{}]", remoteAddress);
    }
}
{code}

In Netty, {{ByteBuf.readBytes(int)}} allocates a *new* ByteBuf containing the extracted bytes. Since the return value is discarded, this buffer is never released, triggering Netty's ResourceLeakDetector:

{noformat}
LEAK: ByteBuf.release() was not called before it's garbage-collected.
...
at org.apache.nifi.distributed.cache.server.codec.CacheRequestDecoder.readHeader(CacheRequestDecoder.java:238)
{noformat}

*Fix*: Replace {{readBytes(HEADER_LENGTH)}} with {{skipBytes(HEADER_LENGTH)}} since the header content is not used.

*Affected versions*: 1.17.0+ and all 2.x (introduced in NIFI-9805)

*Impact*: Low - 4 bytes leaked per new cache client connection. Affects flows using DistributedMapCacheServer, DistributedSetCacheServer, Wait, Notify, DetectDuplicate processors.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)