search

streadway / amqp

Go client for AMQP 0.9.1
http://godoc.org/github.com/streadway/amqp
BSD 2-Clause "Simplified" License
4.88k stars 621 forks source link

Potential overflow of Confirmation DeliveryTag #358

Closed SteelPhase closed 5 years ago

SteelPhase commented 6 years ago

It appears as though RabbitMQ could return a DeliveryTag greater than math.MaxUInt64 if given enough time(centuries maybe). The spec does specify longlong, but nothing in the source for rabbitmq-server seems to limit the DeliveryTag to those bounds. I doubt this really matters, but I thought I'd throw it out there.

https://github.com/streadway/amqp/blob/70e15c650864f4fc47f5d3c82ea117285480895d/spec/amqp0-9-1.stripped.extended.xml#L78

The line that increments the DeliveryTag in RabbitMQ-server

https://github.com/rabbitmq/rabbitmq-server/blob/5e5d8dac8e2635b48e124c77723197d73f4dd2fb/src/rabbit_channel.erl#L1744

Just as an added note: Erlang seems to support Arbitrary length integers, and will not overflow. An error will only occur when there is no longer enough memory to store the integer.

michaelklishin commented 5 years ago

The same issue was brought up with Java and .NET client before. It would take a while to overflow a max UInt64 in practice, so this has to be accepted as a protocol limitation. Note that this limitation is per channel, not connection, and channels have a shorter lifespan than connections in practice.