[CASSANDRA-15790] EmptyType doesn't override writeValue so could attempt to write bytes when expected not to - ASF JIRA

XML

Word

Printable

JSON

Details

Type: Bug
Status: Resolved
Priority: Normal
Resolution: Fixed
Fix Version/s: 3.0.21, 3.11.7, 4.0-beta1, 4.0
Component/s: CQL/Semantics
Labels:
None

Bug Category:
Correctness - Unrecoverable Corruption / Loss
Severity:
Normal
Complexity:
Low Hanging Fruit
Discovered By:
User Report
Platform:

All
Impacts:

None
Since Version:

2.1.0
Source Control Link:

https://github.com/jrwest/cassandra/commit/ea202cea2834dc4140b4a21645eb828f0414cbcd
Test and Documentation Plan:

Hide

circle ci + manual verification

Show
circle ci + manual verification

Description

EmptyType.writeValues is defined here https://github.com/apache/cassandra/blob/e394dc0bb32f612a476269010930c617dd1ed3cb/src/java/org/apache/cassandra/db/marshal/AbstractType.java#L407-L414

public void writeValue(ByteBuffer value, DataOutputPlus out) throws IOException
    {
        assert value.hasRemaining();
        if (valueLengthIfFixed() >= 0)
            out.write(value);
        else
            ByteBufferUtil.writeWithVIntLength(value, out);
    }

This is fine when the value is empty as the write of empty no-ops (the readValue also noops since the length is 0), but if the value is not empty (possible during upgrades or random bugs) then this could silently cause corruption; ideally this should throw a exception if the ByteBuffer has data.

This was called from org.apache.cassandra.db.rows.BufferCell.Serializer#serialize, here we check to see if data is present or not and update the flags. If data is present then and only then do we call type.writeValue (which requires bytes is not empty). The problem is that EmptyType never expects writes to happen, but it still writes them; and does not read them (since it says it is fixed length of 0, so does read(buffer, 0)).