[KUDU-2305] Local variables can overflow when serializing a 2GB message

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6.0
• Fix Version/s: 1.8.0
• Component/s: rpc
• Target Version/s: 1.8.0
• Assignee: Joe McDonnell
• Reporter: Joe McDonnell
• Created: 16/Feb/18 21:50
• Updated: 22/Mar/18 18:53
• Resolved: 22/Mar/18 18:53

Description

When rpc_max_message_size is set to its maximum of INT_MAX (2147483647), certain local variables in SerializeMessage can overflow as messages approach this size. Specifically, recorded_size, size_with_delim, and total_size are 4 byte signed integers and could overflow when additional_size becomes large.

Since INT_MAX is the largest allowable value for rpc_max_message_size (a 4 byte signed integer), these variables will not overflow if changed to 4 byte unsigned integers. This would eliminate the potential problem for serialization.

A similar problem exists in the InboundTransfer::ReceiveBuffer() and similar codepaths. Changing those variables to unsigned integers should resolve the issue.

This does not impact existing systems, because the default value of rpc_max_message_size is 50MB.

Issue Links

• blocks: IMPALA-2567 KRPC milestone 1