Jens Geyer created THRIFT-6031:
----------------------------------
Summary: Harden Lua protocol negative sizes
Key: THRIFT-6031
URL: https://issues.apache.org/jira/browse/THRIFT-6031
Project: Thrift
Issue Type: Bug
Components: Lua - Library
Reporter: Jens Geyer
The Lua library does not consistently validate negative sizes when reading
Thrift payloads.
Size values appear in binary/string fields and in map/list/set headers. Those
values must be non-negative.
- {{TBinaryProtocol}}: {{readListBegin}}, {{readMapBegin}}, {{readSetBegin}},
and {{readString}} have no negative size checks.
- {{TJSONProtocol}}: {{readListBegin}} and {{readMapBegin}} have no negative
size checks.
- {{TCompactProtocol}}: returns {{nil, nil}} for negative size in
{{readListBegin}} instead of raising an exception — silent failure.
Note: the existing {{sz < 0}} check in {{TBinaryProtocol:readMessageBegin}} is
for protocol version detection, not size validation.
This is a protocol hardening gap compared with other runtimes such as C++,
Java, Python, Go, and Node.js.
The fix should add negative-size checks that raise a TProtocolException in the
binary, JSON, and compact protocol read paths.
See THRIFT-6025 for the equivalent Ruby fix.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
