Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Infinite CPU-consuming Loop in VarInt.readVLong/readVInt on truncated InputStream #536

Open
alexlmikh opened this issue May 22, 2021 · 0 comments

Comments

@alexlmikh
Copy link
Contributor

alexlmikh commented May 22, 2021

VarInt read methods operating on InputStream and HollowBlobInput do not check for the end of stream (-1),
resulting in an infinite CPU-consuming loop in case input stream stops (truncated data e.t.c.) in the middle of the varint record (as (-1 & 0x80) == 128).

...
while ((b & 0x80) != 0) {
      b = (byte)in.read(); <-- End of stream (-1) check is missing here !
      value <<= 7;
      value |= (b & 0x7F);
}
...

https://github.com/Netflix/hollow/blame/c7f354dae4b251edee6e43aaab06c6c771131f17/hollow/src/main/java/com/netflix/hollow/core/memory/encoding/VarInt.java#L248

Proposed bugfix: #537

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant