Copilot commented on code in PR #3594:
URL: https://github.com/apache/thrift/pull/3594#discussion_r3469176311
##########
lib/py/src/ext/module.cpp:
##########
@@ -139,11 +139,36 @@ static PyObject* decode_compact(PyObject*, PyObject*
args) {
return decode_impl<CompactProtocol>(args);
}
+static PyObject* decode_binary_from_bytes(PyObject*, PyObject* args) {
+ PyObject* bytes_obj = nullptr;
+ PyObject* typeargs = nullptr;
+ if (!PyArg_ParseTuple(args, "OO", &bytes_obj, &typeargs)) {
+ return nullptr;
+ }
+ if (!PyBytes_Check(bytes_obj)) {
+ PyErr_SetString(PyExc_TypeError, "first argument must be bytes");
+ return nullptr;
+ }
+
+ StructTypeArgs parsedargs;
+ if (!parse_struct_args(&parsedargs, typeargs)) {
+ return nullptr;
+ }
+
+ BinaryProtocol protocol;
+ if (!protocol.prepareDecodeBufferFromBytes(bytes_obj)) {
+ return nullptr;
+ }
+
+ return protocol.readStruct(Py_None, parsedargs.klass, parsedargs.spec);
+}
Review Comment:
`decode_binary` reads `string_length_limit` / `container_length_limit` from
the provided protocol object (see `decode_impl`), but
`decode_binary_from_bytes` always uses the default max limits because it has no
way to accept caller-provided limits. This changes decode semantics and can
bypass size constraints that callers rely on to bound memory/CPU when decoding
untrusted payloads. Consider accepting optional `string_length_limit` and
`container_length_limit` positional args (or similar) and applying them via
`BinaryProtocol::set*Limit()` before decoding.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
