[HADOOP-15424] XDR.ensureFreeSpace hangs when a corrupted bytebuffer passed into the constructor

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.5.0
• Component/s: nfs
• Assignee: Unassigned
• Reporter: John Doe
• Created: 27/Apr/18 18:21
• Updated: 27/Apr/18 18:21

Description

When a corrupted bytebuffer passed into the constructor, i.e., the bytebuffer.capacity = 0, the while loop in XDR.ensureFreeSpace function hangs endlessly.
This is because the loop stride (newCapacity) is always 0, making the loop index (newRemaining) always less than the upper bound (size).
Here is the code snippet.

  public XDR(ByteBuffer buf, State state) {
    this.buf = buf;
    this.state = state;
  }

  private void ensureFreeSpace(int size) {
    Preconditions.checkState(state == State.WRITING);
    if (buf.remaining() < size) {
      int newCapacity = buf.capacity() * 2;
      int newRemaining = buf.capacity() + buf.remaining();

      while (newRemaining < size) {
        newRemaining += newCapacity;
        newCapacity *= 2;
      }

      ByteBuffer newbuf = ByteBuffer.allocate(newCapacity);
      buf.flip();
      newbuf.put(buf);
      buf = newbuf;
    }
  }