Jens Geyer created THRIFT-6168:
----------------------------------
Summary: Add recursion depth limit to skip() in D library
Key: THRIFT-6168
URL: https://issues.apache.org/jira/browse/THRIFT-6168
Project: Thrift
Issue Type: Bug
Components: D - Library
Reporter: Jens Geyer
Fix For: 0.25.0
The skip() free function in the D library (lib/d/src/thrift/protocol/base.d)
recurses through nested structs, lists, maps and sets without a depth bound. A
deeply nested payload can exhaust the call stack.
The counter that bounds struct read/write recursion (THRIFT-6053) is
module-private to thrift.codegen.base, which imports thrift.protocol.base and
not the other way round, so skip() cannot reach it. skip() is called before
dispatch from the generated processor (lib/d/src/thrift/codegen/processor.d, on
an unexpected message type and on an unknown method name), and from the
generated struct readers for unknown fields.
Move the counter and the DEFAULT_MAX_RECURSION_DEPTH constant to
thrift.protocol.base and have skip() draw on the same budget, matching what C++
(TInputRecursionTracker), Java, netstd, Delphi, Haxe, Lua, Perl, PHP, Smalltalk
and OCaml already do; a nested payload is then rejected with
TProtocolException.Type.DEPTH_LIMIT.
D is the last binding whose skip() is unbounded (compare THRIFT-6013 for Ruby,
THRIFT-6014 for JavaScript, THRIFT-6164 for Erlang).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
