Jens Geyer created THRIFT-6085:
----------------------------------
Summary: Add message byte tracking to consumeBuffer() in Java
transports
Key: THRIFT-6085
URL: https://issues.apache.org/jira/browse/THRIFT-6085
Project: Thrift
Issue Type: Bug
Components: Java - Library
Reporter: Jens Geyer
Fix For: 0.24.0
TMemoryInputTransport.consumeBuffer(int len) advanced the buffer read position
without calling countConsumedMessageBytes(len), so remainingMessageSize in
TEndpointTransport was never decremented when a protocol used the fast path
(data already buffered). The same gap existed in
AutoExpandingBufferReadTransport (used by TFastFramedTransport). This let a
caller bypass both maxMessageSize enforcement and
TBinaryProtocol.readString()'s stringLengthLimit_ check on the fast path.
Fixed by having consumeBuffer() call countConsumedMessageBytes() in both
transports, propagating TTransportException through the call chain, and calling
checkStringReadLength() before TBinaryProtocol's fast-path string read.
*Affects:* Java (libthrift), 0.19.0-0.23.0; fixed in 0.24.0
*Fixed by:* commit 2d2b23b2e, PR #3452
*CWE-770:* Allocation of Resources Without Limits or Throttling
*CVSS 4.0:* 6.9 Medium
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N}})
*Reported by:* icysun, via [email protected]
*CVE:* CVE-2026-45112
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
