[
https://issues.apache.org/jira/browse/THRIFT-6071?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer reassigned THRIFT-6071:
----------------------------------
Assignee: Jens Geyer
> Validate container size fits int32 range before narrowing conversion in
> TSimpleJSONProtocol
> -------------------------------------------------------------------------------------------
>
> Key: THRIFT-6071
> URL: https://issues.apache.org/jira/browse/THRIFT-6071
> Project: Thrift
> Issue Type: Bug
> Components: Go - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> ParseElemListBegin reads the list/set element count as int64 via ParseI64,
> but passes int32(nSize) to checkSizeForProtocol. Values larger than
> math.MaxInt32 silently truncate before the check, so the truncated value may
> pass while the full int64 is stored in size and used by generated code for
> container preallocation.
> ReadListBegin and ReadSetBegin both delegate to ParseElemListBegin and are
> affected. binary_protocol, compact_protocol, and json_protocol read sizes as
> int32 directly and are not affected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
