From ea352f0fd7fcea1fcbcd5cf369c10ea43cc0f3f2 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Wed, 24 Jun 2026 20:54:15 +0530 Subject: [PATCH] [KIP-932] Reject out-of-range AcquiredRecords in share fetch reply --- src/rdkafka_fetcher.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/rdkafka_fetcher.c b/src/rdkafka_fetcher.c index 6a29c79260..3614dee5a9 100644 --- a/src/rdkafka_fetcher.c +++ b/src/rdkafka_fetcher.c @@ -1522,6 +1522,23 @@ static rd_kafka_resp_err_t rd_kafka_share_fetch_reply_handle_partition( size = LastOffsets[i] - FirstOffsets[i] + 1; + /* size is used both as the int64 fill-loop bound below + * and, truncated to the int32 types_cnt, as the + * allocation count in + * rd_kafka_share_ack_batch_entry_new. A broker-supplied + * range with LastOffset < FirstOffset, or one wider + * than INT32_MAX, would make the truncated allocation + * smaller than the loop bound and overflow + * entry->types. */ + if (unlikely(size <= 0 || size > INT32_MAX)) + rd_kafka_buf_parse_fail( + rkbuf, + "%.*s [%" PRId32 + "]: AcquiredRecords range %" PRId64 + "..%" PRId64 " out of range", + RD_KAFKAP_STR_PR(topic), PartitionId, + FirstOffsets[i], LastOffsets[i]); + rd_rkb_dbg(rkb, FETCH, "SHAREFETCH", "%.*s [%" PRId32 "]: Acquired Records from offset %" PRId64