[PR] [ISSUE #11256] fix(common): reject malformed hexadecimal identifiers [rocketmq]

["Loyal-Young (via GitHub)" <gi...@apache.org>]

Loyal-Young opened a new pull request, #11257:
URL: https://github.com/apache/rocketmq/pull/11257

   ### Which Issue(s) This PR Fixes
   
   - Fixes #11256.
   
   ### Brief Description
   
   UtilAll.string2bytes silently drops a trailing nibble in odd-length input and maps non-hex characters through -1 into arbitrary bytes. Message identifier parsers can therefore operate on corrupted address/offset data instead of rejecting malformed input.
   
   Validate even length and both ASCII hexadecimal nibbles before decoding; preserve mixed-case and null/empty compatibility.
   
   Reproduction: string2bytes("ABC") silently truncates; string2bytes("G0") produces data rather than rejecting the input.
   
   This is an independent bug fix based on develop `78b96bc5e21216cd7896efae08f90c5cde4cae53`, not stacked on the other contributions. It changes one implementation and adds one regression test file; no new protocol or public API is introduced.
   
   ### How Did You Test This Change?
   
   - The bug-specific regression fails against the unmodified implementation.
   - On this independent branch, JDK 8 / Maven 3.9.9: `UtilAllHexTest,UtilAllTest,MessageClientIDSetterTest,MessageDecoderTest` — 27 tests passed, zero failures/errors/skips.
   - Command: `mvn -pl common -am -Dspotbugs.skip=true -Djacoco.skip=true -Dsurefire.failIfNoSpecifiedTests=false -Dtest=UtilAllHexTest,UtilAllTest,MessageClientIDSetterTest,MessageDecoderTest test`.
   - The combined candidate changes also pass the complete common-module suite: 284 tests, zero failures/errors/skips.
   - Maven Checkstyle passed; `git diff --check` passed. Local runs disable JaCoCo and SpotBugs; this does not claim that upstream GitHub Actions have run or passed.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org