Jens-G opened a new pull request, #3601:
URL: https://github.com/apache/thrift/pull/3601

   ## Summary
   
   `ParseElemListBegin` reads the list/set element count from the wire as 
`int64` via `ParseI64`, but passes `int32(nSize)` to `checkSizeForProtocol`. 
Values larger than `math.MaxInt32` are silently narrowed before the check; the 
truncated value may pass while the full `int64` is stored in `size` and 
returned to callers.
   
   The fix adds an explicit range check (`nSize > math.MaxInt32`) before the 
narrowing cast, returning `SIZE_LIMIT` immediately. The existing 
`checkSizeForProtocol` call is retained for the normal range.
   
   `ReadListBegin` and `ReadSetBegin` both delegate to `ParseElemListBegin` and 
are covered by this change. `binary_protocol`, `compact_protocol`, and 
`json_protocol` read container sizes as `int32` directly and are not affected.
   
   Related: PR #3599 addresses an analogous issue in `ReadMapBegin`; the same 
guard should be added there once that fix lands.
   
   ## Test plan
   
   - [ ] `TestReadSimpleJSONProtocolListBeginSizeOverflow` — new test covering 
list and set; verifies `SIZE_LIMIT` is returned for a declared size of `1<<32 + 
1` (which `int32` truncation would reduce to `1`)
   - [ ] Full Go library test suite: `go test ./...` passes
   
   🤖 Generated with [Claude Code](https://claude.ai/code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to