Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spring microservice encounters infinite loop when calling readLongs method resulting in denied access. #1034

Closed
Zlase0820 opened this issue Dec 8, 2023 · 3 comments

Comments

@Zlase0820
Copy link

Describe the bug
A clear and concise description of what the bug is.
While using Spring microservices, I utilized the 【com.esotericsoftware.kryo.unsafe.UnsafeInput.readLongs()】 method, but encountered an infinite loop, resulting in denied access to the microservice. I have written a POC here that you can use to reproduce the issue. Could you please take a look and let me know your thoughts? Thank you very much.
Please let me know if you need any clarification or have additional details to add about the issue you encountered. I'm happy to assist further.

To Reproduce
Provide a minimal reproducible example of the problem, ideally in the form of a runnable test-case.
public void main() {
UnsafeInput unsafeInput = new UnsafeInput();
long[] result = unsafeInput.readLongs(20);
}

Environment:

  • OS: [e.g. windows10]
  • JDK Version: [e.g. 11]
  • Kryo Version: [e.g. 5.5.0]

    com.esotericsoftware
    kryo
    5.5.0

Additional context
Add any other context about the problem here.

@Zlase0820
Copy link
Author

The infinite loop occurs in the while loop of the com.esotericsoftware.kryo.unsafe.UnsafeInput.readBytes method

@theigl
Copy link
Collaborator

theigl commented Dec 8, 2023

I think your test-case is too minimal. You cannot use UnsafeInput without a buffer:

/** Creates an uninitialized Input, {@link #setBuffer(byte[])} must be called before the Input is used. */
public UnsafeInput () {
}

Can you create a reproducer that uses a valid input?

@theigl
Copy link
Collaborator

theigl commented Feb 20, 2024

Closing for now. Please re-open if you can provide more details.

@theigl theigl closed this as completed Feb 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

2 participants