[
https://issues.apache.org/jira/browse/THRIFT-6133?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dmytro Shteflyuk resolved THRIFT-6133.
--------------------------------------
Fix Version/s: 0.25.0
Resolution: Fixed
> Ruby native MemoryBufferTransport handles oversized reads consistently
> ----------------------------------------------------------------------
>
> Key: THRIFT-6133
> URL: https://issues.apache.org/jira/browse/THRIFT-6133
> Project: Thrift
> Issue Type: Bug
> Components: Ruby - Library
> Reporter: Dmytro Shteflyuk
> Assignee: Dmytro Shteflyuk
> Priority: Major
> Fix For: 0.25.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> h3. Problem
> The native implementation of {{MemoryBufferTransport#read_all}} converts the
> requested length to a C {{int}} before comparing it with the bytes available.
> A positive Compact string length above {{INT_MAX}} therefore raises Ruby
> {{RangeError}} instead of the read failure emitted by pure Ruby.
> h3. Client impact
> Ruby clients using native {{MemoryBufferTransport}} observe a Ruby
> implementation exception for a truncated oversized read, whereas pure Ruby
> reports {{EOFError}}. Parser fuzzing treats {{EOFError}} as malformed input
> and exits on this inconsistent exception.
> h3. Reproduction
> {code:sh}
> bundle exec rake build_ext
> bundle exec ruby -Ilib -e 'require "thrift";
> Thrift::MemoryBufferTransport.new("x").read_all(3_397_380_576)'
> {code}
> Testing on master commit {{f69c2078b7c11c09aa4f8b8879d8b41342145461}}
> produces:
> {code}
> -e:1:in 'Thrift::MemoryBufferTransport#read_all': integer 3397380576 too big
> to convert to 'int' (RangeError)
> {code}
> h3. Expected behavior
> A positive length that exceeds the bytes available from a
> {{MemoryBufferTransport}} raises {{EOFError}} in both native and pure Ruby.
> Invalid negative lengths continue to raise the existing Thrift transport
> exception.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
