[
https://issues.apache.org/jira/browse/THRIFT-1205?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13052066#comment-13052066
]
Bryan Duxbury commented on THRIFT-1205:
---------------------------------------
bq. Actually, readFrame() is free to read the frame in chunks of any size,
avoiding the need for upfront allocation
This is true for FramedTransport, but not for the nonblocking servers
themselves. We make an important distinction between the IO part of the request
and the deserialization part of the request.
bq. this can be solved for all transports by having the deserializer ask for
chunks instead of walking a whole frame
I don't think you should underestimate the amount of work this would be. It's a
completely different scheme for deserialization.
> port server unduly fragile with arbitrary input
> -----------------------------------------------
>
> Key: THRIFT-1205
> URL: https://issues.apache.org/jira/browse/THRIFT-1205
> Project: Thrift
> Issue Type: Bug
> Components: Java - Library
> Affects Versions: 0.6.1
> Environment: javac 1.5.0_19, OS X 10.4.11
> Reporter: Toby Thain
> Priority: Critical
> Labels: security
>
> Telnetting to the port and type a couple of arbitrary characters crashes the
> server almost immediately as follows. I haven't glanced at the relevant code.
> Is this reproducible on other platforms?
> {noformat}
> $ ./run-server.sh
> Starting the simple server...
> Exception in thread "Thread-0" java.lang.OutOfMemoryError: Java heap space
> at
> org.apache.thrift.protocol.TBinaryProtocol.readStringBody(TBinaryProtocol.java:353)
> at
> org.apache.thrift.protocol.TBinaryProtocol.readMessageBegin(TBinaryProtocol.java:215)
> at SimonSays$Processor.process(Unknown Source)
> at org.apache.thrift.server.TSimpleServer.serve(TSimpleServer.java:70)
> at JavaServer.simple(Unknown Source)
> at JavaServer$1.run(Unknown Source)
> at java.lang.Thread.run(Thread.java:613)
> {noformat}
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
