[BUG] Malformed cluster token server frames may trigger excessive allocation or corrupt request decoding

[yungyu16]

Issue Description

Type: bug report

Describe what happened

The cluster token server decoders trust length and count fields received from the network before fully validating them. A malformed request can declare an oversized Ping namespace length or an invalid ParamFlow parameter count/string length. This may cause excessive allocation, out-of-bounds reads, or leave unread bytes in the current frame.

Describe what you expected to happen

All externally supplied lengths and counts should be validated before allocation or iteration. A structurally invalid frame should be rejected and its connection closed so that no residual bytes can affect a later request.

How to reproduce it (as minimally and precisely as possible)

1. Start the default cluster token server.
2. Send a Ping frame whose declared namespace length differs from the bytes remaining, or a ParamFlow frame with a negative/impossible count or string length.
3. Observe invalid allocation/read behavior or incomplete consumption of the malformed frame.

Tell us your environment

Sentinel 1.8 branch, default Netty cluster token server.

Anything else we need to know?

PR #3572 adds strict frame validation, connection-close handling, and regression tests covering valid requests, malformed/truncated lengths, invalid ParamFlow fields, trailing bytes, and oversized frames.

[oss-sentinel-ai]

Issue Evaluation

Category: bug | Status: Confirmed

Verified against the current codebase on branch 1.8. The cluster token server decoders do trust length/count fields from the network before validation:

PingRequestDataDecoder (sentinel-cluster-server-default):

• Reads length via source.readInt() then allocates new byte[length] without checking length <= source.readableBytes()
• A crafted frame with length >> actual data causes IndexOutOfBoundsException or excessive memory allocation

ParamFlowRequestDataDecoder (sentinel-cluster-server-default):

• Reads amount (param count) and per-param length without bounds checks
• Negative length → NegativeArraySizeException; oversized length → excessive allocation or OOB read
• decodeParam() does not validate that source.readableBytes() >= length before source.readBytes()

NettyRequestDecoder:

• Contains // TODO handle decode error here — confirms missing error handling path

Impact: Medium-High — malformed frames from untrusted network peers can cause excessive allocation, OOB reads, or frame corruption affecting subsequent requests on the same connection.
Severity: High — affects cluster mode availability and could be exploited for DoS.

Note: PR #3572 by the same author already proposes a fix with regression tests. Maintainers should review that PR.

---

Automated evaluation by oss-sentinel-ai

[oss-sentinel-ai]

Issue Evaluation

Category: bug | Status: Confirmed

Verified against the current codebase on branch 1.8. The cluster token server decoders do trust length/count fields from the network before validation:

PingRequestDataDecoder (sentinel-cluster-server-default):

• Reads length via source.readInt() then allocates new byte[length] without checking length <= source.readableBytes()
• A crafted frame with length >> actual data causes IndexOutOfBoundsException or excessive memory allocation

ParamFlowRequestDataDecoder (sentinel-cluster-server-default):

• Reads amount (param count) and per-param length without bounds checks
• Negative length → NegativeArraySizeException; oversized length → excessive allocation or OOB read
• decodeParam() does not validate that source.readableBytes() >= length before source.readBytes()

NettyRequestDecoder:

• Contains // TODO handle decode error here — confirms missing error handling path

Impact: Medium-High — malformed frames from untrusted network peers can cause excessive allocation, OOB reads, or frame corruption affecting subsequent requests on the same connection.
Severity: High — affects cluster mode availability and could be exploited for DoS.

Note: PR #3572 by the same author already proposes a fix with regression tests. Maintainers should review that PR.

---

Automated evaluation by oss-sentinel-ai