Jens Geyer created THRIFT-6366:
----------------------------------
Summary: Erlang: bound the size of a message the binary and
compact protocols read
Key: THRIFT-6366
URL: https://issues.apache.org/jira/browse/THRIFT-6366
Project: Thrift
Issue Type: Bug
Components: Erlang - Library
Reporter: Jens Geyer
{{thrift_binary_protocol}} and {{thrift_compact_protocol}} read a string or
binary with whatever length its header declares, and nothing bounds the size of
a message as a whole. The Erlang library has had a setting for this since
THRIFT-6283: the thrift application's {{max_message_size}}, 100 MB by default
({{?DEFAULT_MAX_MESSAGE_SIZE}}). So far only the replies
{{thrift_http_transport}} reads are held to it.
h2. Change
* Both protocols read a message only up to {{max_message_size}}. That is the
{{max_message_size}} option of {{new/2}} or of the protocol factory, or else
the application setting as it is when the protocol is created.
* Each read takes its bytes from what the message may still take, before they
are read. A string whose declared length would take the message past the
maximum is refused on its length alone.
* {{message_begin}} sets that budget and {{message_end}} clears it. Between
messages each read is held to the maximum on its own, so structs read without a
message around them do not add up.
* A refusal is {{\{error, \{message_size_exceeds_maximum, Max\}\}}}.
{{message_begin}} returns it. Inside a message it fails the read the way other
read errors do, and the server closes that connection.
* {{thrift_client_util}} passes a {{max_message_size}} client option on to the
protocol. {{thrift_socket_server}} takes only atom protocols, so a server uses
the application setting.
A message over 100 MB was accepted before and is now refused, unless the
setting is raised.
Reported by Sylwester Lachiewicz.
_Drafted with AI assistance (Claude Opus 5.5)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
