You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "zjncs (via GitHub)" <gi...@apache.org> on 2026/09/08 04:19:49 UTC
[PR] fix(common): fall back to the higher version for negative version values [rocketmq]
zjncs opened a new pull request, #11066:
URL: https://github.com/apache/rocketmq/pull/11066
### Motivation
`MQVersion.getVersionDesc(int)` and `value2Version(int)` guard only the upper bound:
```java
public static Version value2Version(int value) {
Version[] versions = VERSION_VALUES;
int length = versions.length;
if (value >= length) {
return versions[length - 1];
}
return versions[value]; // value < 0 -> ArrayIndexOutOfBoundsException
}
```
A negative value indexes `VERSION_VALUES[-1]` and throws `ArrayIndexOutOfBoundsException`.
This is reachable from the wire: `RocketMQSerializable` decodes the remoting header version as a **signed short** (`headerBuffer.readShort()`), so a peer sending version bytes `0xFFFF` produces `value == -1`. The namesrv broker-registration path (`DefaultRequestProcessor` → `MQVersion.value2Version(request.getVersion())`) and `getVersionDesc(conn.getVersion())` in the tools/broker connection commands both consume that wire-controlled value, and crash with AIOOBE instead of answering cleanly.
### Modifications
Extend both guards to `value < 0 || value >= length`, falling back to the last entry — consistent with the existing "unknown → HIGHER_VERSION" semantics already pinned by `testValue2Version_HigherVersion`.
### Verification
Fail-before (new test `testNegativeVersionFallsBackToHigherVersion`, run against the unpatched code):
```
Tests run: 2, Failures: 0, Errors: 1 -- MQVersionTest
java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 613
```
Pass-after:
```
Tests run: 5, Failures: 0, Errors: 0, Skipped: 0 -- MQVersionTest
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org