Jens-G commented on PR #3597: URL: https://github.com/apache/thrift/pull/3597#issuecomment-4712420980
### Code review Found 2 issues: 1. Security disclosure language in public PR text (AGENTS.md ยง6 says "Never describe the change as a security fix in public-facing text โ commit messages, PR titles, PR descriptions, or inline comments. Use neutral functional language.") The PR title "fix off-by-ten header bounds check in readHeaderFormat" and body "a malformed THeader frame makes them read past the end of the buffer" explicitly describe a memory-safety exploitation path triggered by untrusted network input. Per AGENTS.md ยง6, changes touching serialization bounds and transport parsing should use neutral functional language (e.g. "correct the header section length check in readHeaderFormat") and be coordinated through `[email protected]` before public disclosure. https://github.com/apache/thrift/blob/983c813c9a1a2302d9a3ae23d7368beceaac2d0a/AGENTS.md#L89-L97 2. Missing JIRA ticket and commit message format (AGENTS.md ยง2 says "Significant changes | Required for all non-trivial PRs" and "PR title format: `THRIFT-9999: Short description of the change`") The PR title does not follow the `THRIFT-NNNN:` prefix format, the JIRA checklist box is unchecked, and the commit message has no `THRIFT-NNNN:` prefix or `Client: cpp` line. https://github.com/apache/thrift/blob/983c813c9a1a2302d9a3ae23d7368beceaac2d0a/AGENTS.md#L26-L36 ๐ค Generated with [Claude Code](https://claude.ai/code) <sub>- If this code review was useful, please react with ๐. Otherwise, react with ๐.</sub> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
