Jens Geyer created THRIFT-6071:
----------------------------------
Summary: Validate container size fits int32 range before narrowing
conversion in TSimpleJSONProtocol
Key: THRIFT-6071
URL: https://issues.apache.org/jira/browse/THRIFT-6071
Project: Thrift
Issue Type: Bug
Components: Go - Library
Reporter: Jens Geyer
ParseElemListBegin reads the list/set element count as int64 via ParseI64, but
passes int32(nSize) to checkSizeForProtocol. Values larger than math.MaxInt32
silently truncate before the check, so the truncated value may pass while the
full int64 is stored in size and used by generated code for container
preallocation.
ReadListBegin and ReadSetBegin both delegate to ParseElemListBegin and are
affected. binary_protocol, compact_protocol, and json_protocol read sizes as
int32 directly and are not affected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
