Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service

Overview

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes _size - 1 without validating _size; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).

Root Cause: In src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to _size - 1, where _size is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the subsequent resize() throws an exception that is not caught.

Affected Scenarios: bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server configurations are not affected.

How to Fix:

1. Upgrade bRPC to a version that includes this fix.
2. Apply the patch in PR  https://github.com/apache/brpc/pull/3450

Affected

• apache/brpc < 1.18.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.