[CASSANDRA-15470] Potential Overflow in DatabaseDescriptor Functions That Convert Between KB/MB & Bytes

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 4.0-alpha4, 4.0
• Component/s: Local/Config
• Labels: pull-request-available
• Bug Category: Code - Bug - Unclear Impact
• Severity: Low
• Complexity: Low Hanging Fruit
• Discovered By: Code Inspection
• Platform: All
• Since Version: 5.0

Source Control Link

https://github.com/apache/cassandra/commit/7b637d5c2dbfcb387fc24d4d7145f6eb1e2f2052

Test and Documentation Plan

Unit tests written for newly added validations

• Assignee: Mallika Kulkarni
• Reporter: Jordan West

Authors

Mallika Kulkarni

Reviewers

Dinesh Joshi, Jordan West

• Created: 06/Jan/20 12:10
• Updated: 07/Mar/23 11:52
• Resolved: 05/Feb/20 19:59

Description

DatabaseDescriptor has several functions that convert between user supplied sizes in KB/MB and bytes. These are implemented without much consistency and, while unlikely, several have the potential to overflow since validation on the input is missing. Meanwhile, some widen the number to a long correctly. Options include: widening in all places or simply doing better validation on start up — currently only the lower bound of the valid range is checked for many of these fields.

List of Affected DatabaseDescriptor Methods:

• getColumnIndexSize
• getColumnIndexCacheSize
• getBatchSizeWarnThreshold
• getNativeTransportFrameBlockSize
• getRepairSessionSpaceInMegabytes
• getNativeTransportMaxFrameSize

Issue Links

• links to: GitHub Pull Request #425
• mentioned in: Page Loading...