[ https://issues.apache.org/jira/browse/THRIFT-1205?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13050886#comment-13050886 ]
Bryan Duxbury commented on THRIFT-1205: --------------------------------------- @Toby - The problem is that "typing a bunch of characters" is indistinguishable from the first few bytes of a really long message. I'd really like to have a good solution to this problem so I can point to that in the future, but so far no one has managed to propose a workable solution. @Ryan - I'd accept a patch for decreasing the default size to something reasonably large, if you spun a good argument for it. > port server unduly fragile with arbitrary input > ----------------------------------------------- > > Key: THRIFT-1205 > URL: https://issues.apache.org/jira/browse/THRIFT-1205 > Project: Thrift > Issue Type: Bug > Components: Java - Library > Affects Versions: 0.6.1 > Environment: javac 1.5.0_19, OS X 10.4.11 > Reporter: Toby Thain > Priority: Critical > Labels: security > > Telnetting to the port and type a couple of arbitrary characters crashes the > server almost immediately as follows. I haven't glanced at the relevant code. > Is this reproducible on other platforms? > {noformat} > $ ./run-server.sh > Starting the simple server... > Exception in thread "Thread-0" java.lang.OutOfMemoryError: Java heap space > at > org.apache.thrift.protocol.TBinaryProtocol.readStringBody(TBinaryProtocol.java:353) > at > org.apache.thrift.protocol.TBinaryProtocol.readMessageBegin(TBinaryProtocol.java:215) > at SimonSays$Processor.process(Unknown Source) > at org.apache.thrift.server.TSimpleServer.serve(TSimpleServer.java:70) > at JavaServer.simple(Unknown Source) > at JavaServer$1.run(Unknown Source) > at java.lang.Thread.run(Thread.java:613) > {noformat} -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira