dxbjavid opened a new pull request, #3604: URL: https://github.com/apache/thrift/pull/3604
the go binary, compact and json protocol readers work out the container precheck size as `size * minElemSize` using a 32-bit int, so a crafted element count read off the wire wraps the signed product back into the accepted range and an oversized map/list/set header slips past the maxMessageSize bound that guards container allocation. the json readers also truncate the int64 count with int32() before that multiply. the same overflow was handled for the c++ and c_glib bindings in #3590 but the go side was left as is, so this routes the reads through a small helper that does the multiply in 64 bits and rejects counts past the int32 range. added a regression test that drives each reader with such a count. - [ ] Did you create an [Apache Jira](https://issues.apache.org/jira/projects/THRIFT/issues/) ticket? ([Request account here](https://selfserve.apache.org/jira-account.html), not required for trivial changes) - [ ] If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"? - [x] Did you squash your changes to a single commit? (not required, but preferred) - [x] Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"? - [ ] If your change does not involve any code, include `[skip ci]` anywhere in the commit message to free up build resources. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
