dxbjavid opened a new pull request, #3585: URL: https://github.com/apache/thrift/pull/3585
thrift_protocol_skip recurses through nested structs, lists, sets and maps with no depth guard, so a server skipping an unknown field (the dispatch processor calls it on every unrecognised method) can be driven into unbounded recursion by a deeply nested message and overflow the stack. The configuration already carries recursionLimit_ with a default of 64 but nothing reads it. I noticed this reading the c_glib skip next to the C++ one, which guards the same path with TInputRecursionTracker. This routes skip through an internal helper that tracks depth and stops at the configured limit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
