[jira] [Resolved] (THRIFT-6262) Go: THeaderTransport.Flush truncates the frame length instead of refusing an oversized frame

["Jens Geyer (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/THRIFT-6262?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jens Geyer resolved THRIFT-6262.
--------------------------------
    Fix Version/s: 0.25.0
         Assignee: Jens Geyer
       Resolution: Fixed

> Go: THeaderTransport.Flush truncates the frame length instead of refusing an oversized frame
> --------------------------------------------------------------------------------------------
>
>                 Key: THRIFT-6262
>                 URL: https://issues.apache.org/jira/browse/THRIFT-6262
>             Project: Thrift
>          Issue Type: Bug
>          Components: Go - Library
>            Reporter: Jens Geyer
>            Assignee: Jens Geyer
>            Priority: Major
>             Fix For: 0.25.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> {{lib/go/thrift/header_transport.go}}, in {{Flush()}} ({{:713}}):
> {code:go}
> binary.BigEndian.PutUint32(buf, uint32(payload.Len()))
> if _, err := t.transport.Write(buf); err != nil {
> 	return NewTTransportExceptionFromError(err)
> }
> {code}
> There is no upper bound on the write side at all -- the configured {{MaxFrameSize}} is applied when reading, not when flushing -- so this transport will happily emit a frame no conforming peer will accept.
> On a 64-bit build the missing bound also turns into silent corruption: {{payload.Len()}} is an {{int}}, which is 64-bit there, and the conversion to {{uint32}} wraps, so a payload of 4 GiB + n writes a length of n and the peer reads a frame that does not match what follows. (On a 32-bit build {{int}} is 32-bit and {{payload.Len()}} cannot exceed {{MaxInt32}}, so only the missing bound applies.)
> The read side refuses what it cannot accept; the write side should not produce what no peer can read.
> h2. Suggested fix
> Check {{payload.Len()}} against {{t.cfg.GetMaxFrameSize()}} (and against {{math.MaxUint32}}) before the conversion and return a {{TTransportException}} of type {{SIZE_LIMIT}} rather than writing a truncated length.
> _Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens Geyer._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)