Details
Description
If the client sets a large document (example is 10MB) and for some reason closes the connection before memcached returns status there's a risk of leaking the document size of data.
1. Mcd reads the binary protocol header and sees a value length of 10MB.
2. Mcd uses engine allocate and creates a 10MB item.
3. Mcd goes around conn_nread pulling the value off the socket which requires a few goes to get all 10MB
Meanwhile... client gives up (small lcb_set_timeout) and closes the connection.
3. (contd.) Mcd encouters a read from socket error.
4. Mcd returns false from conn_nread, event loop terminates
In this failure path, there's no item release code, in this example we leak 10MB.