[jira] [Created] (THRIFT-6261) PHP: TCompactProtocol accepts a negative container size where TBinaryProtocol rejects it

["Jens Geyer (Jira)" <ji...@apache.org>]

Jens Geyer created THRIFT-6261:
----------------------------------

             Summary: PHP: TCompactProtocol accepts a negative container size where TBinaryProtocol rejects it
                 Key: THRIFT-6261
                 URL: https://issues.apache.org/jira/browse/THRIFT-6261
             Project: Thrift
          Issue Type: Bug
          Components: PHP - Library
            Reporter: Jens Geyer


{{lib/php/lib/Protocol/TBinaryProtocol.php}} rejects a container size below zero in {{readMapBegin()}}, {{readListBegin()}} and {{readSetBegin()}}:

{code:php}
if ($size < 0) {
    throw new TProtocolException('Negative size', TProtocolException::NEGATIVE_SIZE);
}
{code}

{{lib/php/lib/Protocol/TCompactProtocol.php}} has no such check. {{readMapBegin()}} ({{:519}}) takes its size straight from {{readVarint()}}, and {{readCollectionBegin()}} ({{:504}}), which serves both {{readListBegin()}} and {{readSetBegin()}}, does the same for the long form:

{code:php}
$size = $sizeType >> 4;
$type = $this->getTType($sizeType);
if ($size == 15) {
    $result += $this->readVarint($size);
}
{code}

The size then reaches the generated {{read()}} loops, which run {{for ($i = 0; $i < $size; ...)}} -- so a negative value silently yields an empty container instead of the protocol error the binary protocol raises for the same input. The two protocols should answer the same input the same way.

h2. Suggested fix

Add the {{NEGATIVE_SIZE}} check to {{readMapBegin()}} and {{readCollectionBegin()}}, worded as in {{TBinaryProtocol}}.

_Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens Geyer._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)