thrift-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Christian Ciach (JIRA)" <>
Subject [jira] [Updated] (THRIFT-4362) Missing size-check can lead to huge memory allocation
Date Tue, 10 Oct 2017 18:08:00 GMT


Christian Ciach updated THRIFT-4362:
    Attachment: check-size.patch

> Missing size-check can lead to huge memory allocation
> -----------------------------------------------------
>                 Key: THRIFT-4362
>                 URL:
>             Project: Thrift
>          Issue Type: Bug
>          Components: Java - Library
>    Affects Versions: 0.9.3, 0.10.0
>            Reporter: Christian Ciach
>         Attachments: check-size.patch
> In some cases the method {{org.apache.thrift.protocol.TBinaryProtocol.readStringBody(int
size)}} gets called with a "size" parameter that has not been validated by the existing method
{{checkStringReadLength(int size)}}.
> This is true if the method is called by {{readMessageBegin()}} of the same class. The
method {{readString()}} checks the size correctly before calling {{readStringBody(int size)}}.
> Since the readMessageBegin-method is public, there may be other callers who don't check
the size before calling this method.
> We encountered this issue in production several times. Because of this we are currently
using our own patched version of libthrift-0.9.3. The patch is attached, but it is surely
not the best solution, because with this patch the size may be checked twice, depending on
the caller.

This message was sent by Atlassian JIRA

View raw message