Bug 640312 - Messaging allows invalid encoding of strings with length > 64K
Summary: Messaging allows invalid encoding of strings with length > 64K
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: python-qpid
Version: beta
Hardware: All
OS: Linux
high
urgent
Target Milestone: 1.3.2-RC2
: ---
Assignee: Ken Giusti
QA Contact: Petr Matousek
URL:
Whiteboard:
Depends On:
Blocks: 667735
TreeView+ depends on / blocked
 
Reported: 2010-10-05 14:29 UTC by Ken Giusti
Modified: 2014-06-09 14:13 UTC (History)
6 users (show)

Fixed In Version: python-qpid-0.7.946106-15
Doc Type: Bug Fix
Doc Text:
Cause QPID clients that send a message containing a string which is greater than 65535 bytes in length. Consequence The client silently truncates the string to 65535 bytes in length, which corrupts the contained data. Fix QPID does not support strings greater than 65535 bytes in length. The encoding code now checks the length of all strings sent by clients, and enforces this length limit. Result Should a client attempt to send a string with a length greater than 65535 bytes, an exception shall be thrown.
Clone Of:
: 667735 (view as bug list)
Environment:
Last Closed: 2011-02-15 12:12:16 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
A V2-based agent that provides a string echo method. (5.53 KB, application/x-gzip)
2010-10-05 14:34 UTC, Ken Giusti
no flags Details
Proposed fix. (15.76 KB, patch)
2010-10-27 13:39 UTC, Ken Giusti
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:0217 0 normal SHIPPED_LIVE Red Hat Enterprise MRG Messaging and Grid bug fix and enhancement update 2011-02-15 12:10:15 UTC

Description Ken Giusti 2010-10-05 14:29:13 UTC
Description of problem:

The 0.10 codecs (both C++ and python) will allow the encoding of a string data type with a length that is greater than 64K.  The 0.10 codec only defines string encodings that allow for strings up to 64K in length (length is encoded as a 16-bit unsigned integer).


Version-Release number of selected component (if applicable):
beta

How reproducible:
100%

Steps to Reproduce:
1. Send a message containing a string of length > 65535 bytes long.

  
Actual results:
Varies by implementation - C++ appears to convert the string to a vbin type.  Python appears to corrupt the encoded length value. 

Expected results:
0.10 does not support strings > 65535 bytes in length - attempting to send message containing such a string should fail and notify the calling application (e.g. throw an exception).

Additional info:

Comment 1 Ken Giusti 2010-10-05 14:34:57 UTC
Created attachment 451681 [details]
A V2-based agent that provides a string echo method.

Can be used to reproduce the string encoding error.  Run the agent like this:

./run_nozzle -b host:port -n 1 -t 10 -q

A client can then query the agent for a data object _class="data", and invoke the echo method on the data object.  The method takes a string argument.  Attempting to invoke the method with a string with length > 65K will result in a timeout error.  It should fail immediately with an error indicating the string is too long.

Example client code:

#!/usr/bin/python                                                               

# $ ./big-echo.py mrg2.lab.bos.redhat.com 20                                    

from qmf.console import *

import sys

url, size = sys.argv[1:3]
size = int(size)

s = Session()
b = s.addBroker(url)
a = b.getAgents()[1]
d = a.getObjects(_class="data")[0]

d.echo(1, "x" * size)

s.delBroker(b)

Comment 2 Ken Giusti 2010-10-27 13:39:52 UTC
Created attachment 455973 [details]
Proposed fix.

Proposed patch: will throw an exception if an attempt is to encode a value that cannot be represented by the target type.

Comment 3 Gordon Sim 2010-10-27 15:01:39 UTC
Comment on attachment 455973 [details]
Proposed fix.

Seems reasonable fix to me.

Comment 4 Ken Giusti 2010-10-28 15:26:47 UTC
Upstream JIRA:

https://issues.apache.org/jira/browse/QPID-2916

Comment 6 Gordon Sim 2011-01-06 16:20:46 UTC
This bug now covers only the python component of the fix. Bug 667735 covers the c++ component.

Comment 7 Ken Giusti 2011-01-24 18:15:38 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause
    QPID clients that send a message containing a string which is greater than 65535 bytes in length.
Consequence
    The client silently truncates the string to 65535 bytes in length, which corrupts the contained data.
Fix
    QPID does not support strings greater than 65535 bytes in length.  The encoding code now checks the length of all strings sent by clients, and enforces this length limit.
Result
    Should a client attempt to send a string with a length greater than 65535 bytes, an exception shall be thrown.

Comment 8 Petr Matousek 2011-01-25 16:06:41 UTC
The issue has been fixed

Verified on RHEL4.8 and RHEL5.6, architectures: i386, x86_64

packages installed:
python-qpid-0.7.946106-15

VERIFIED

Comment 9 errata-xmlrpc 2011-02-15 12:12:16 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0217.html


Note You need to log in before you can comment on or make changes to this bug.