Jens-G opened a new pull request, #3948: URL: https://github.com/apache/thrift/pull/3948
[THRIFT-6365](https://issues.apache.org/jira/browse/THRIFT-6365), a sub-task of [THRIFT-6291](https://issues.apache.org/jira/browse/THRIFT-6291). The Lua library had no limit on the number of elements a list, set or map may declare. `readListBegin`, `readSetBegin` and `readMapBegin` of the binary, compact and JSON protocols refused only a negative size, and the generated code reads one element per declared element. **Change.** `TProtocol.lua` gains `DEFAULT_MAX_CONTAINER_SIZE` and `TProtocolBase:checkContainerSize()`, next to the existing string size limit. Each of the six container readers calls it after the negative-size check, before any element is read. `maxContainerSize` on a protocol instance overrides the default. Zero or less switches the limit off, the convention THRIFT-6291 settles. **Default.** Lua has no MaxMessageSize, so nothing else bounds the count. The limit therefore gets a finite default of 16384000 elements, the value of the string and frame size limits, instead of the "no limit of its own" default the specification gives MaxContainerSize. `doc/specs/thrift-tconfiguration.md` records the exception and the reason. - Every element takes at least one byte on the wire, so the default refuses no message that fits into one frame of the default size. - A container of more than 16384000 elements, which only an unframed transport can carry, now needs `maxContainerSize` raised. The ticket carries the Breaking-Change label for that case. **Tests.** `lib/lua/test/test_container_limits.lua` runs in `make check`. It uses a complete, well-formed container of limit + 1 one-byte elements, so the unfixed code visibly reads it all. - On master, 49 of its 88 checks fail: the container is read in full, and the default, the 16384001-element header and `skip` go through. With the change, all 88 pass, on Lua 5.3 and 5.4. - The test's pure-Lua stand-in for `libluabpack` gains the `int8_t` wrap of `'c'` and `toVarint32`, both as in `luabpack.c`, which the compact protocol needs. - Locally, the `lib-lua` job's steps also pass for both versions: `make -C lib/lua check` and the lua-lua cross test. - [x] Did you create an [Apache Jira](https://issues.apache.org/jira/projects/THRIFT/issues/) ticket? THRIFT-6365 - [x] If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"? - [x] Did you squash your changes to a single commit? - [x] Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"? It is labelled. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
