You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@thrift.apache.org by "Sachin Tappe (Jira)" <ji...@apache.org> on 2019/11/06 07:34:00 UTC
[jira] [Commented] (THRIFT-4024) Skip() should throw on unknown
data types
[ https://issues.apache.org/jira/browse/THRIFT-4024?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16968137#comment-16968137 ]
Sachin Tappe commented on THRIFT-4024:
--------------------------------------
Hi Does this resolved CVE-2019-0205: potential DoS when processing untrusted Thrift payloads?
Also is this fix applicable to Java library?
Thanks,
Sachin
> Skip() should throw on unknown data types
> -----------------------------------------
>
> Key: THRIFT-4024
> URL: https://issues.apache.org/jira/browse/THRIFT-4024
> Project: Thrift
> Issue Type: Bug
> Components: C# - Library, Delphi - Library, Go - Library, Haxe - Library, netcore - Library
> Affects Versions: 0.10.0
> Reporter: Michael Antipin
> Assignee: James E. King III
> Priority: Major
> Fix For: 0.13.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> I'm using TBinaryProtocol and a simple transport that reads from a given byte array.
> C# library contains the following code in TProtocolUtil.Skip(TProtocol prot, TType type):
> {code}
> case TType.List:
> TList list = prot.ReadListBegin();
> for (int i = 0; i < list.Count; i++) {
> Skip(prot, list.ElementType);
> }
> prot.ReadListEnd();
> break;
> {code}
> The type of elements is detected in ReadListBegin(), and, as Skip() does nothing for unknown types, the position in the binary remains the same until the for loop completes.
> So, when you try to deserialize invalid data, and a field type happens to be detected as TType.List, you may end up waiting for a random period of time until deserialization is completed (734707176 iterations of skipping in my case).
> I suggest throwing an exception immediately when list elements type is unknown. May be, it would be good to have a setting like *FailOnUnknownType*, so that Skip() will throw instead of ignoring.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)