[THRIFT-2660] Validate the bytes received in TSaslTransport

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.9
• Fix Version/s: 0.9.2
• Component/s: Java - Library
• Patch Info: Patch Available
• Assignee: Roger Meier
• Reporter: Harsh J
• Created: 12/Aug/14 20:08
• Updated: 05/Nov/14 04:48
• Resolved: 13/Aug/14 10:38

Description

In TSaslTransport#receiveSaslMessage, we are doing two things incorrectly:

• Not validating the status byte code.
• Not validating the decoded payload size integer before allocating a whole array with it.

The latter especially is bad when a network security software sends a thrift server port some garbage data, causing it to receive failures like:

java.lang.OutOfMemoryError: Java heap space
	at org.apache.thrift.transport.TSaslTransport.receiveSaslMessage(TSaslTransport.java:181)
	at org.apache.thrift.transport.TSaslServerTransport.handleSaslStartMessage(TSaslServerTransport.java:125)
	at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)

Or even,

ERROR org.apache.thrift.server.TThreadPoolServer: Error occurred during processing of message.
java.lang.NegativeArraySizeException
        at org.apache.thrift.transport.TSaslTransport.receiveSaslMessage(TSaslTransport.java:181)
        at org.apache.thrift.transport.TSaslServerTransport.handleSaslStartMessage(TSaslServerTransport.java:125)
        at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)

Issue Links

• is related to: HIVE-6468 HS2 & Metastore using SASL out of memory error when curl sends a get request
• relates to: THRIFT-2678 Make max message size configurable