mysql/replication: bound the intervals preallocation in ParseMysql56GTIDSet

go/mysql/replication/mysql56_gtid_set.go

@@ -91,7 +91,20 @@ func ParseMysql56GTIDSet(s string) (Mysql56GTIDSet, error) {
 			return nil, vterrors.Wrapf(err, "invalid MySQL 5.6 GTID set (%q)", s)
 		}
 
-		intervals := make([]interval, 0, strings.Count(tail, ":")+1)
+		// The capacity is only a hint to append, so bounding it cannot change the
+		// parsed result. It is bounded because the hint is derived from untrusted
+		// input: a valid SID followed by a long run of colons would otherwise
+		// reserve one interval per colon before any interval is parsed, and
+		// parseInterval below rejects the very first one.
+		//
+		// The bound is a fraction of the remaining input rather than a constant, so
+		// a genuinely long interval list still gets a useful hint: the shortest
+		// possible interval is "N-M:" so the count cannot exceed len(tail)/4.
+		nIntervals := strings.Count(tail, ":") + 1
+		if max := len(tail)/4 + 1; nIntervals > max {
+			nIntervals = max
+		}
+		intervals := make([]interval, 0, nIntervals)
 		for len(tail) > 0 {
 			if idx := strings.IndexByte(tail, ':'); idx >= 0 {
 				head = tail[:idx]

go/mysql/replication/mysql56_gtid_set_test.go

@@ -17,8 +17,10 @@
 package replication
 
 import (
+	"fmt"
 	"maps"
 	"reflect"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -902,3 +904,40 @@
 	require.Len(t, sids, 1)
 	assert.Equal(t, "8bc65cca-3fe4-11ed-bbfb-091034d48b3e", sids[0].String())
 }
+
+// TestParseMysql56GTIDSetIntervalsCapHint checks that the preallocation hint for
+// the intervals slice does not follow a count taken from the input beyond what that
+// input could hold, while a genuinely long interval list still parses unchanged.
+// The hostile case asserts on allocation volume, because a colon run parses without
+// error either way once the intervals are all discarded.
+func TestParseMysql56GTIDSetIntervalsCapHint(t *testing.T) {
+	const sid = "00010203-0405-0607-0809-0a0b0c0d0e0f"
+
+	// Results must be identical either side of the bound.
+	for _, n := range []int{1, 10, 100, 1023, 1024, 1025, 2051, 5000} {
+		var sb strings.Builder
+		sb.WriteString(sid)
+		for i := 0; i < n; i++ {
+			// non-overlapping ascending intervals, so none are merged or discarded
+			fmt.Fprintf(&sb, ":%d-%d", 2*i+1, 2*i+1)
+		}
+		got, err := ParseMysql56GTIDSet(sb.String())
+		require.NoError(t, err, "n=%d", n)
+		sidVal, err := ParseSID(sid)
+		require.NoError(t, err)
+		assert.Len(t, got[sidVal], n, "n=%d", n)
+	}
+
+	// A long run of colons carries no intervals at all, so reserving one per colon
+	// is pure waste. 1MiB of colons is 16MiB of interval structs unbounded.
+	hostile := sid + ":" + strings.Repeat(":", 1<<20)
+	var before, after runtime.MemStats
+	runtime.GC()
+	runtime.ReadMemStats(&before)
+	_, _ = ParseMysql56GTIDSet(hostile)
+	runtime.ReadMemStats(&after)
+	allocated := after.TotalAlloc - before.TotalAlloc
+	assert.Less(t, allocated, uint64(8<<20),
+		"parsing %d colons allocated %d bytes for intervals that are all discarded",
+		1<<20, allocated)
+}