GitHub user dvirsky opened a pull request:
https://github.com/apache/thrift/pull/511
Limit lists to 10,000 items in fastbinary decoding to avoid crashing â¦
â¦servers from huge allocations on junk/mallicious input
https://issues.apache.org/jira/browse/THRIFT-3175
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/EverythingMe/thrift THRIFT-3175
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/thrift/pull/511.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #511
----
commit 988defdbdc12d2f087c0a87f8f6205b41f8588aa
Author: Dvir Volk <[email protected]>
Date: 2015-06-02T07:55:43Z
Limit lists to 10,000 items in fastbinary decoding to avoid crashing
servers from huge allocations on junk/mallicious input
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
