Jens-G opened a new pull request, #3601: URL: https://github.com/apache/thrift/pull/3601
## Summary `ParseElemListBegin` reads the list/set element count from the wire as `int64` via `ParseI64`, but passes `int32(nSize)` to `checkSizeForProtocol`. Values larger than `math.MaxInt32` are silently narrowed before the check; the truncated value may pass while the full `int64` is stored in `size` and returned to callers. The fix adds an explicit range check (`nSize > math.MaxInt32`) before the narrowing cast, returning `SIZE_LIMIT` immediately. The existing `checkSizeForProtocol` call is retained for the normal range. `ReadListBegin` and `ReadSetBegin` both delegate to `ParseElemListBegin` and are covered by this change. `binary_protocol`, `compact_protocol`, and `json_protocol` read container sizes as `int32` directly and are not affected. Related: PR #3599 addresses an analogous issue in `ReadMapBegin`; the same guard should be added there once that fix lands. ## Test plan - [ ] `TestReadSimpleJSONProtocolListBeginSizeOverflow` — new test covering list and set; verifies `SIZE_LIMIT` is returned for a declared size of `1<<32 + 1` (which `int32` truncation would reduce to `1`) - [ ] Full Go library test suite: `go test ./...` passes 🤖 Generated with [Claude Code](https://claude.ai/code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
