[
https://issues.apache.org/jira/browse/THRIFT-6085?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6085.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Add message byte tracking to consumeBuffer() in Java transports
> ---------------------------------------------------------------
>
> Key: THRIFT-6085
> URL: https://issues.apache.org/jira/browse/THRIFT-6085
> Project: Thrift
> Issue Type: Bug
> Components: Java - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> TMemoryInputTransport.consumeBuffer(int len) advanced the buffer read
> position without calling countConsumedMessageBytes(len), so
> remainingMessageSize in TEndpointTransport was never decremented when a
> protocol used the fast path (data already buffered). The same gap existed in
> AutoExpandingBufferReadTransport (used by TFastFramedTransport). This let a
> caller bypass both maxMessageSize enforcement and
> TBinaryProtocol.readString()'s stringLengthLimit_ check on the fast path.
> Fixed by having consumeBuffer() call countConsumedMessageBytes() in both
> transports, propagating TTransportException through the call chain, and
> calling checkStringReadLength() before TBinaryProtocol's fast-path string
> read.
> *Affects:* Java (libthrift), 0.19.0-0.23.0; fixed in 0.24.0
> *Fixed by:* commit 2d2b23b2e, PR #3452
> *CWE-770:* Allocation of Resources Without Limits or Throttling
> *CVSS 4.0:* 6.9 Medium
> ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N}})
> *Reported by:* icysun, via [email protected]
> *CVE:* CVE-2026-45112
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
