Limit response sizes from query-frontends - #13829
Bugbot Review
Bugbot Analysis Progress (7m 14s elapsed)
✅ Gathered PR context (3s)
✅ Analyzed code changes (1s)
✅ Completed bug detection — 3 potential bugs found (6m 59s)
✅ Validation and filtering completed (1s)
✅ Posted analysis results — 3 bugs reported (11s)
✅ Analysis completed successfully (0s)
Final Result: Bugbot completed review and found 3 potential issues
Request ID: serverGenReqId_6ad21484-8863-4882-8f30-4f26bd71cf3f
Details
Bug: Missing limit check in WriteUint16 early return path
In the forked json-iterator library, WriteUint16 is missing an enforceMaxBytes() call on its early return path when the value is less than 1000. While WriteUint32 correctly calls enforceMaxBytes() on all return paths (lines 82, 90, 104), WriteUint16 only calls it at line 61, not at the early return on line 56. This means when marshalling uint16/int16 values less than 1000, those specific bytes bypass the limit check, potentially allowing responses to slightly exceed the configured MaxResponseSizeBytes limit before the next write operation catches it.
vendor/github.com/json-iterator/go/stream_int.go#L53-L56
mimir/vendor/github.com/json-iterator/go/stream_int.go
Lines 53 to 56 in 9e702fe