Dmytro Shteflyuk created THRIFT-6133:
----------------------------------------
Summary: Ruby native MemoryBufferTransport handles oversized reads
consistently
Key: THRIFT-6133
URL: https://issues.apache.org/jira/browse/THRIFT-6133
Project: Thrift
Issue Type: Bug
Components: Ruby - Library
Reporter: Dmytro Shteflyuk
Assignee: Dmytro Shteflyuk
h3. Problem
The native implementation of {{MemoryBufferTransport#read_all}} converts the
requested length to a C {{int}} before comparing it with the bytes available. A
positive Compact string length above {{INT_MAX}} therefore raises Ruby
{{RangeError}} instead of the read failure emitted by pure Ruby.
h3. Client impact
Ruby clients using native {{MemoryBufferTransport}} observe a Ruby
implementation exception for a truncated oversized read, whereas pure Ruby
reports {{EOFError}}. Parser fuzzing treats {{EOFError}} as malformed input and
exits on this inconsistent exception.
h3. Reproduction
{code:sh}
bundle exec rake build_ext
bundle exec ruby -Ilib -e 'require "thrift";
Thrift::MemoryBufferTransport.new("x").read_all(3_397_380_576)'
{code}
Testing on master commit {{f69c2078b7c11c09aa4f8b8879d8b41342145461}} produces:
{code}
-e:1:in 'Thrift::MemoryBufferTransport#read_all': integer 3397380576 too big to
convert to 'int' (RangeError)
{code}
h3. Expected behavior
A positive length that exceeds the bytes available from a
{{MemoryBufferTransport}} raises {{EOFError}} in both native and pure Ruby.
Invalid negative lengths continue to raise the existing Thrift transport
exception.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
