[jira] [Resolved] (THRIFT-6071) Validate container size fits int32 range before narrowing conversion in TSimpleJSONProtocol

["Jens Geyer (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/THRIFT-6071?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jens Geyer resolved THRIFT-6071.
--------------------------------
    Fix Version/s: 0.24.0
       Resolution: Fixed

> Validate container size fits int32 range before narrowing conversion in TSimpleJSONProtocol
> -------------------------------------------------------------------------------------------
>
>                 Key: THRIFT-6071
>                 URL: https://issues.apache.org/jira/browse/THRIFT-6071
>             Project: Thrift
>          Issue Type: Bug
>          Components: Go - Library
>            Reporter: Jens Geyer
>            Assignee: Jens Geyer
>            Priority: Major
>             Fix For: 0.24.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> ParseElemListBegin reads the list/set element count as int64 via ParseI64, but passes int32(nSize) to checkSizeForProtocol. Values larger than math.MaxInt32 silently truncate before the check, so the truncated value may pass while the full int64 is stored in size and used by generated code for container preallocation.
> ReadListBegin and ReadSetBegin both delegate to ParseElemListBegin and are affected. binary_protocol, compact_protocol, and json_protocol read sizes as int32 directly and are not affected.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)