[
https://issues.apache.org/jira/browse/THRIFT-6145?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dmytro Shteflyuk resolved THRIFT-6145.
--------------------------------------
Fix Version/s: 0.25.0
Resolution: Fixed
> Validate Ruby Compact decoder varint and binary size bounds
> -----------------------------------------------------------
>
> Key: THRIFT-6145
> URL: https://issues.apache.org/jira/browse/THRIFT-6145
> Project: Thrift
> Issue Type: Bug
> Components: Ruby - Library
> Reporter: Dmytro Shteflyuk
> Assignee: Dmytro Shteflyuk
> Priority: Major
> Fix For: 0.25.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h3. Problem
> The Ruby CompactProtocol decoder accepts fifth-byte payload bits that do not
> fit in a 32-bit varint. The pure-Ruby and native implementations then produce
> different values for the same bytes. Compact binary length prefixes are
> decoded as unsigned 32-bit values and passed to the transport even when they
> exceed the signed int32 size domain used by Thrift binary values.
> h3. Client impact
> Malformed Compact input can be interpreted inconsistently by the pure-Ruby
> and native decoders. Oversized declared binary lengths are delegated to
> {{read_all}} instead of being rejected by CompactProtocol, so callers receive
> a transport or EOF failure rather than a protocol size exception.
> h3. Reproduction
> {code:ruby}
> require "thrift"
> overflow = [0x80, 0x80, 0x80, 0x80, 0x10].pack("C*")
> protocol = Thrift::CompactProtocol.new(
> Thrift::MemoryBufferTransport.new(overflow)
> )
> p protocol.read_i32
> oversized = [0x80, 0x80, 0x80, 0x80, 0x08].pack("C*")
> protocol = Thrift::CompactProtocol.new(
> Thrift::MemoryBufferTransport.new(oversized)
> )
> protocol.read_binary
> {code}
> Testing on master commit {{c2def39207a73394420088da9b4b105571dd9036}}
> produces:
> * {{read_i32}} returns {{2147483648}} in pure Ruby and {{0}} with the native
> extension for {{80 80 80 80 10}}.
> * Binary length prefixes for {{2147483648}} and {{4294967295}} reach
> {{read_all}} with those values and then raise {{EOFError}}.
> * A valid fifth-byte varint, signed {{i32}} minimum, binary length
> {{2147483647}}, and a one-byte binary value remain accepted.
> h3. Expected behavior
> CompactProtocol should reject fifth-byte payload bits outside the uint32
> domain with {{ProtocolException::INVALID_DATA}}. Binary lengths above
> {{2147483647}} should raise {{ProtocolException::SIZE_LIMIT}} before the
> protocol calls {{read_all}}. Valid uint32 varints, signed {{i32}} values,
> binary sizes through {{INT32_MAX}}, and ordinary Compact messages should
> remain supported.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
