dxbjavid opened a new pull request, #3599: URL: https://github.com/apache/thrift/pull/3599
TSimpleJSONProtocol.ReadMapBegin reads the map size off the wire into iSize, but the following checkSizeForProtocol call is passed int32(size) where size is the named return value that is still zero at that point, so the MaxMessageSize limit is always tested against 0 and the real size is never bounded before it is returned. A peer can therefore declare an oversized map and have it slip past the configured limit, which then feeds the map preallocation in generated read code. The sibling ParseElemListBegin used for lists and sets already validates the value it read off the wire, so this just points the map check at iSize to match it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
