You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org> on 2010/06/04 02:08:00 UTC
[jira] Created: (HADOOP-6809) rpc allow creating arbitrary size of
objects
rpc allow creating arbitrary size of objects
--------------------------------------------
Key: HADOOP-6809
URL: https://issues.apache.org/jira/browse/HADOOP-6809
Project: Hadoop Common
Issue Type: Bug
Components: io
Reporter: Tsz Wo (Nicholas), SZE
When o.a.h.ipc.Server receives a rpc method call, it reads the parameters by initializing an o.a.h.ipc.RPC.Invocation object, which read the parameter values by calling ObjectWritable.readObject(..). However, ObjectWritable.readObject(..) does not limit the object size and may create objects with arbitrary size. As a consequence, any rpc client may create large objects in the server by passing large parameter objects.
For example, a user application may creates large objects in the namenode by calling DistributedFileSystem.setOwner(p, username, groupname) if username or groupname are large strings. In such case, it could easily bring down the namenode.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-6809) RPC allows clients to create objects
with arbitrary size on the server
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-6809?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-6809:
-------------------------------------------
Summary: RPC allows clients to create objects with arbitrary size on the server (was: rpc allow creating arbitrary size of objects)
> RPC allows clients to create objects with arbitrary size on the server
> ----------------------------------------------------------------------
>
> Key: HADOOP-6809
> URL: https://issues.apache.org/jira/browse/HADOOP-6809
> Project: Hadoop Common
> Issue Type: Bug
> Components: ipc
> Reporter: Tsz Wo (Nicholas), SZE
>
> When o.a.h.ipc.Server receives a rpc method call, it reads the parameters by initializing an o.a.h.ipc.RPC.Invocation object, which read the parameter values by calling ObjectWritable.readObject(..). However, ObjectWritable.readObject(..) does not limit the object size and may create objects with arbitrary size. As a consequence, any rpc client may create large objects in the server by passing large parameter objects.
> For example, a user application may creates large objects in the namenode by calling DistributedFileSystem.setOwner(p, username, groupname) if username or groupname are large strings. In such case, it could easily bring down the namenode.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (HADOOP-6809) rpc allow creating arbitrary size of
objects
Posted by "Tsz Wo (Nicholas), SZE (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HADOOP-6809?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz Wo (Nicholas), SZE updated HADOOP-6809:
-------------------------------------------
Component/s: ipc
(was: io)
> rpc allow creating arbitrary size of objects
> --------------------------------------------
>
> Key: HADOOP-6809
> URL: https://issues.apache.org/jira/browse/HADOOP-6809
> Project: Hadoop Common
> Issue Type: Bug
> Components: ipc
> Reporter: Tsz Wo (Nicholas), SZE
>
> When o.a.h.ipc.Server receives a rpc method call, it reads the parameters by initializing an o.a.h.ipc.RPC.Invocation object, which read the parameter values by calling ObjectWritable.readObject(..). However, ObjectWritable.readObject(..) does not limit the object size and may create objects with arbitrary size. As a consequence, any rpc client may create large objects in the server by passing large parameter objects.
> For example, a user application may creates large objects in the namenode by calling DistributedFileSystem.setOwner(p, username, groupname) if username or groupname are large strings. In such case, it could easily bring down the namenode.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.