Jens Geyer created THRIFT-6028:
----------------------------------
Summary: Harden Perl protocol negative sizes
Key: THRIFT-6028
URL: https://issues.apache.org/jira/browse/THRIFT-6028
Project: Thrift
Issue Type: Bug
Components: Perl - Library
Reporter: Jens Geyer
The Perl library does not validate negative sizes when reading Thrift payloads.
Size values appear in binary/string fields and in map/list/set headers. Those
values must be non-negative. In the current Perl implementation, a malformed
payload can declare a negative size and the value is passed directly to the
transport read path without rejection.
This is a protocol hardening gap compared with other runtimes such as C++,
Java, Python, Go, and Node.js, which all raise a NEGATIVE_SIZE exception.
The fix should add negative-size checks in:
- {{TBinaryProtocol::readListBegin}}
- {{TBinaryProtocol::readMapBegin}}
- {{TBinaryProtocol::readSetBegin}}
- {{TBinaryProtocol::readString}} / {{readStringBody}}
See THRIFT-6025 for the equivalent Ruby fix.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
