Jens-G commented on PR #3599: URL: https://github.com/apache/thrift/pull/3599#issuecomment-4731587780
### Code review Found 1 issue: 1. The PR body describes the bypass mechanism in detail. Per [AGENTS.md ยง6](https://github.com/apache/thrift/blob/983c813c9a1a2302d9a3ae23d7368beceaac2d0a/AGENTS.md#L87-L95), changes touching serialization bounds must use neutral, functional language in all public-facing text (PR descriptions, commit messages, inline comments) โ without describing exploitation paths. Vulnerability details should travel through the private ASF channel (`[email protected]`). https://github.com/apache/thrift/blob/983c813c9a1a2302d9a3ae23d7368beceaac2d0a/AGENTS.md#L89-L95 --- **Validation: list/set and other protocols** The same class of bug (`checkSizeForProtocol` receiving the wrong variable) was audited across the Go library: - `simple_json_protocol.go` `ParseElemListBegin` (list/set): checks `int32(nSize)` โ the wire-read value โ correctly. Not affected. - `binary_protocol.go` `ReadMapBegin`/`ReadListBegin`/`ReadSetBegin`: all compute `totalMinSize` from the wire-read `size32`. Not affected. - `compact_protocol.go` `ReadMapBegin`/`ReadListBegin`/`ReadSetBegin`: all use the wire-read values directly. Not affected. - `json_protocol.go` `ReadMapBegin`/`ReadListBegin`/`ReadSetBegin`: `ReadMapBegin` checks `int32(iSize)` directly; list/set delegate to `ParseElemListBegin`. Not affected. The bug is isolated to `ReadMapBegin` in `TSimpleJSONProtocol`. ๐ค Generated with [Claude Code](https://claude.ai/code) <sub>- If this code review was useful, please react with ๐. Otherwise, react with ๐.</sub> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
