[
https://issues.apache.org/jira/browse/THRIFT-6031?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6031.
--------------------------------
Fix Version/s: 0.24.0
Assignee: Jens Geyer
Resolution: Fixed
> Harden Lua protocol negative sizes
> ----------------------------------
>
> Key: THRIFT-6031
> URL: https://issues.apache.org/jira/browse/THRIFT-6031
> Project: Thrift
> Issue Type: Bug
> Components: Lua - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> The Lua library does not consistently validate negative sizes when reading
> Thrift payloads.
> Size values appear in binary/string fields and in map/list/set headers. Those
> values must be non-negative.
> - {{TBinaryProtocol}}: {{readListBegin}}, {{readMapBegin}}, {{readSetBegin}},
> and {{readString}} have no negative size checks.
> - {{TJSONProtocol}}: {{readListBegin}} and {{readMapBegin}} have no negative
> size checks.
> - {{TCompactProtocol}}: returns {{nil, nil}} for negative size in
> {{readListBegin}} instead of raising an exception — silent failure.
> Note: the existing {{sz < 0}} check in {{TBinaryProtocol:readMessageBegin}}
> is for protocol version detection, not size validation.
> This is a protocol hardening gap compared with other runtimes such as C++,
> Java, Python, Go, and Node.js.
> The fix should add negative-size checks that raise a TProtocolException in
> the binary, JSON, and compact protocol read paths.
> See THRIFT-6025 for the equivalent Ruby fix.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
