You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Alexey Serbin (Code Review)" <ge...@cloudera.org> on 2026/06/10 04:57:06 UTC
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Alexey Serbin has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24433
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
[subprocess] Fix buffer over-read/overflow in message discard
SubprocessProtocol::DoReadAndDiscard() clears an oversized message off
the communication channel using a fixed 4K stack buffer, but bounded
each read() with std::max<ssize_t>(rem, sizeof(buf)) instead of
std::min(). Since this returns the greater of the two, the read length
is never held to the buffer size. This causes two issues:
* Stack buffer overflow: when the discarded payload is larger than
4K (say, 8K message), a single read() is asked to copy up to 'rem'
bytes into the 4K buffer, smashing the stack.
* Valid message subsumption: when the oversized payload is smaller than
4K, the read still pulls up to 4K, over-reading into and consuming the
following well-formed message. The next ReceiveMessage() then loses
that message, breaking the "discard to re-sync the channel" guarantee.
The bug has existed since DoReadAndDiscard() was introduced in KUDU-3450.
The patch fixes it by limiting each read to std::min(rem, sizeof(buf)),
matching the Java implementation in doReadAndDiscard.
Add two unit tests covering both scenarios: a deterministic over-read
and an oversized-payload overflow test.
Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Reviewed-on: http://gerrit.cloudera.org:8080/24427
Reviewed-by: Alexey Serbin <al...@apache.org>
Tested-by: Alexey Serbin <al...@apache.org>
(cherry picked from commit c968d85cc9d5ea18cbabf7464cb48bbec51a63a6)
---
M src/kudu/subprocess/subprocess_protocol.cc
M src/kudu/subprocess/subprocess_server-test.cc
2 files changed, 104 insertions(+), 1 deletion(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/33/24433/1
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: newchange
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24433 )
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
Patch Set 1:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/2644/
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: comment
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Wed, 10 Jun 2026 04:57:14 +0000
Gerrit-HasComments: No
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24433 )
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
Patch Set 1: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/2644/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: comment
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Wed, 10 Jun 2026 05:43:19 +0000
Gerrit-HasComments: No
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has removed a vote on this change.
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
Removed Verified-1 by Kudu Jenkins (120)
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: deleteVote
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Posted by "Ashwani Raina (Code Review)" <ge...@cloudera.org>.
Ashwani Raina has posted comments on this change. ( http://gerrit.cloudera.org:8080/24433 )
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
Patch Set 1: Code-Review+1
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: comment
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Wed, 10 Jun 2026 05:04:51 +0000
Gerrit-HasComments: No
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/24433 )
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
Patch Set 1: Verified+1
Due to pre-commit CI pipeline limitations of using common workspace for all the branches and recent switch to JDK17, this update for branch-1.17.x cannot be compiled and tested as a regular one.
I manually verified that the build pass and the relevant tests pass.
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: comment
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Wed, 10 Jun 2026 22:04:31 +0000
Gerrit-HasComments: No
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has posted comments on this change. ( http://gerrit.cloudera.org:8080/24433 )
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: comment
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Wed, 10 Jun 2026 22:05:57 +0000
Gerrit-HasComments: No
[kudu-CR](branch-1.17.x) [subprocess] Fix buffer over-read/overflow in message discard
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24433 )
Change subject: [subprocess] Fix buffer over-read/overflow in message discard
......................................................................
[subprocess] Fix buffer over-read/overflow in message discard
SubprocessProtocol::DoReadAndDiscard() clears an oversized message off
the communication channel using a fixed 4K stack buffer, but bounded
each read() with std::max<ssize_t>(rem, sizeof(buf)) instead of
std::min(). Since this returns the greater of the two, the read length
is never held to the buffer size. This causes two issues:
* Stack buffer overflow: when the discarded payload is larger than
4K (say, 8K message), a single read() is asked to copy up to 'rem'
bytes into the 4K buffer, smashing the stack.
* Valid message subsumption: when the oversized payload is smaller than
4K, the read still pulls up to 4K, over-reading into and consuming the
following well-formed message. The next ReceiveMessage() then loses
that message, breaking the "discard to re-sync the channel" guarantee.
The bug has existed since DoReadAndDiscard() was introduced in KUDU-3450.
The patch fixes it by limiting each read to std::min(rem, sizeof(buf)),
matching the Java implementation in doReadAndDiscard.
Add two unit tests covering both scenarios: a deterministic over-read
and an oversized-payload overflow test.
Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Reviewed-on: http://gerrit.cloudera.org:8080/24427
Reviewed-by: Alexey Serbin <al...@apache.org>
Tested-by: Alexey Serbin <al...@apache.org>
(cherry picked from commit c968d85cc9d5ea18cbabf7464cb48bbec51a63a6)
Reviewed-on: http://gerrit.cloudera.org:8080/24433
Reviewed-by: Ashwani Raina <ar...@gmail.com>
Reviewed-by: Abhishek Chennaka <ac...@cloudera.com>
---
M src/kudu/subprocess/subprocess_protocol.cc
M src/kudu/subprocess/subprocess_server-test.cc
2 files changed, 104 insertions(+), 1 deletion(-)
Approvals:
Ashwani Raina: Looks good to me, but someone else must approve
Alexey Serbin: Verified
Abhishek Chennaka: Looks good to me, approved
--
To view, visit http://gerrit.cloudera.org:8080/24433
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: merged
Gerrit-Change-Id: I73da816132555cb3d29b7bbf8a6821ad3f2dec9c
Gerrit-Change-Number: 24433
Gerrit-PatchSet: 2
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Ashwani Raina <ar...@gmail.com>
Gerrit-Reviewer: Kudu Jenkins (120)