[jira] [Created] (THRIFT-6133) Ruby native MemoryBufferTransport handles oversized reads consistently

["Dmytro Shteflyuk (Jira)" <ji...@apache.org>]

Dmytro Shteflyuk created THRIFT-6133:
----------------------------------------

             Summary: Ruby native MemoryBufferTransport handles oversized reads consistently
                 Key: THRIFT-6133
                 URL: https://issues.apache.org/jira/browse/THRIFT-6133
             Project: Thrift
          Issue Type: Bug
          Components: Ruby - Library
            Reporter: Dmytro Shteflyuk
            Assignee: Dmytro Shteflyuk


h3. Problem

The native implementation of {{MemoryBufferTransport#read_all}} converts the requested length to a C {{int}} before comparing it with the bytes available. A positive Compact string length above {{INT_MAX}} therefore raises Ruby {{RangeError}} instead of the read failure emitted by pure Ruby.

h3. Client impact

Ruby clients using native {{MemoryBufferTransport}} observe a Ruby implementation exception for a truncated oversized read, whereas pure Ruby reports {{EOFError}}. Parser fuzzing treats {{EOFError}} as malformed input and exits on this inconsistent exception.

h3. Reproduction

{code:sh}
bundle exec rake build_ext
bundle exec ruby -Ilib -e 'require "thrift"; Thrift::MemoryBufferTransport.new("x").read_all(3_397_380_576)'
{code}

Testing on master commit {{f69c2078b7c11c09aa4f8b8879d8b41342145461}} produces:

{code}
-e:1:in 'Thrift::MemoryBufferTransport#read_all': integer 3397380576 too big to convert to 'int' (RangeError)
{code}

h3. Expected behavior

A positive length that exceeds the bytes available from a {{MemoryBufferTransport}} raises {{EOFError}} in both native and pure Ruby. Invalid negative lengths continue to raise the existing Thrift transport exception.




--
This message was sent by Atlassian Jira
(v8.20.10#820010)