Security context

Highlights

Denial of Service: 17 prior fixes. Scrutinize any change in this area.

cassandra/cluster.py: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Memory Safety: Lack of bounds checks on buffer sizes before casting pointers (e.g., to C integer types) allows out-of-bounds memory reads when processing malformed database responses. Developers must strictly validate input buffer sizes prior to pointer casts.

Buffer Overflow: Unsafe buffer slicing and missing exception propagation during binary reads allow out-of-bounds memory accesses. Ensuring exceptions are explicitly propagated (e.g., 'except NULL') and checking EOF is critical when reading raw payload bytes.

Denial of Service: The use of native C 64-bit integer types for left-shifting during varint unpacking leads to integer overflows. Forcing arbitrary-precision Python operations prevents overflow crashes on massive payloads.