[AVRO-391] DoS possible on java rpc servers

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.3.0
• Component/s: java

Environment

OpenJDK 1.6, Linux

• Assignee: Unassigned
• Reporter: Eric Evans
• Created: 01/Feb/10 17:50
• Updated: 05/Apr/10 17:30

Description

It is possible to crash an avro rpc server (java) by writing random strings to the socket:

Try...
echo "boom" | nc localhost 9160

You get...
java.lang.OutOfMemoryError: Java heap space
at java.nio.HeapByteBuffer.<init>(HeapByteBuffer.java:57)
at java.nio.ByteBuffer.allocate(ByteBuffer.java:329)
at org.apache.avro.ipc.SocketTransceiver.readBuffers(SocketTransceiver.java:65)
at org.apache.avro.ipc.SocketServer$Connection.run(SocketServer.java:91)
at java.lang.Thread.run(Thread.java:636)

Issue Links

• is related to: AVRO-144 add random RPC request tests