Skip to content

rdkafka_broker.c: Potential Interger Overflow #4987

@stasos24

Description

@stasos24

Since inflight_cnt, retry_cnt, outq_cnt has int type

static void rd_kafka_broker_timeout_scan(rd_kafka_broker_t *rkb, rd_ts_t now) {
int inflight_cnt, retry_cnt, outq_cnt;

And rd_atomic64_add accepts two int64

librdkafka/src/rdatomic.h

Lines 144 to 145 in 9387761

static RD_INLINE int64_t RD_UNUSED rd_atomic64_add(rd_atomic64_t *ra,
int64_t v) {

There is possible integer overflow at:

rd_atomic64_add(&rkb->rkb_c.req_timeouts,
inflight_cnt + outq_cnt);

Possible fix:
<static_cast>(int64) inflight_cnt + outq_cnt

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions