Uploaded image for project: 'Cassandra'
  1. Cassandra
  2. CASSANDRA-14925

DecimalSerializer.toString() can be used as OOM attack

    XMLWordPrintableJSON

Details

    Description

      Currently, in DecimalSerializer.toString(value), it uses BigDecimal.toPlainString() which generates huge string for large scale values.

       

      BigDecimal d = new BigDecimal("1e-" + (Integer.MAX_VALUE - 6));
      d.toPlainString(); // oom

       

      Propose to use BigDecimal.toString() when scale is larger than 100 which is configurable via -Dcassandra.decimal.maxscaleforstring

       

      patch circle-ci
      trunk unit

      The code should apply cleanly to 3.0+.

      Attachments

        Activity

          People

            jasonstack Zhao Yang
            jasonstack Zhao Yang
            Zhao Yang
            Benjamin Lerer
            Votes:
            1 Vote for this issue
            Watchers:
            7 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: