binder: BinderChannelBuilder and BinderServerBuilder should implement maxInboundMessageSize()
- Dominant language
- Java
- Stars
- 12.1k
- Forks
- 4k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 37
Description
### Is your feature request related to a problem?
Yes. Senders can trivially OOM a peer with an unending sequence of non-empty [stream transactions](https://github.com/grpc/proposal/blob/master/L73-java-binderchannel/wireformat.md?plain=1) with the `FLAG_MESSAGE_DATA_IS_PARTIAL` flag set.
### Describe the solution you'd like
grpc-binder should establish a default value for client and server `maxInboundMessageSize()`. If a receiver sees a transaction that would cause the next message to exceed this limit, it should "out of band close" the stream with `RESOURCE_EXHAUSTED`.
### Describe alternatives you've considered
None
### Additional context
Even with [stream flow control](https://github.com/grpc/proposal/commit/ea98aa6ee643c6a1b5d5b8a36d8c9ffba7a5342d) receivers must ack transactions whenever the application has `request()`ed at least one message. That design had been relying on this message-layer limit but grpc-binder doesn't seem to implement one.
Contributor guide
Assessment
This issue has not been assessed yet.