You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@thrift.apache.org by "Hudson (JIRA)" <ji...@apache.org> on 2014/11/05 05:49:10 UTC
[jira] [Commented] (THRIFT-2660) Validate the bytes received in
TSaslTransport
[ https://issues.apache.org/jira/browse/THRIFT-2660?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14197561#comment-14197561 ]
Hudson commented on THRIFT-2660:
--------------------------------
SUCCESS: Integrated in Thrift #1331 (See [https://builds.apache.org/job/Thrift/1331/])
THRIFT-2660 Validate the bytes received in TSaslTransport (roger: rev c983250355bc5fd572a6b56fc5637461ef868ec8)
* lib/java/test/org/apache/thrift/transport/TestTSaslTransports.java
* lib/java/src/org/apache/thrift/transport/TSaslTransport.java
THRIFT-2660 Validate the bytes received in TSaslTransport (roger: rev 5f841dff8b264708fe961186bd26c1016acdfca4)
* lib/java/src/org/apache/thrift/transport/TSaslTransport.java
* lib/java/test/org/apache/thrift/transport/TestTSaslTransports.java
> Validate the bytes received in TSaslTransport
> ---------------------------------------------
>
> Key: THRIFT-2660
> URL: https://issues.apache.org/jira/browse/THRIFT-2660
> Project: Thrift
> Issue Type: Bug
> Components: Java - Library
> Affects Versions: 0.9
> Reporter: Harsh J
> Assignee: Roger Meier
> Fix For: 0.9.2
>
> Attachments: THRIFT-2660.patch, THRIFT-2660.patch
>
>
> In TSaslTransport#receiveSaslMessage, we are doing two things incorrectly:
> - Not validating the status byte code.
> - Not validating the decoded payload size integer before allocating a whole array with it.
> The latter especially is bad when a network security software sends a thrift server port some garbage data, causing it to receive failures like:
> {code}
> java.lang.OutOfMemoryError: Java heap space
> at org.apache.thrift.transport.TSaslTransport.receiveSaslMessage(TSaslTransport.java:181)
> at org.apache.thrift.transport.TSaslServerTransport.handleSaslStartMessage(TSaslServerTransport.java:125)
> at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
> {code}
> Or even,
> {code}
> ERROR org.apache.thrift.server.TThreadPoolServer: Error occurred during processing of message.
> java.lang.NegativeArraySizeException
> at org.apache.thrift.transport.TSaslTransport.receiveSaslMessage(TSaslTransport.java:181)
> at org.apache.thrift.transport.TSaslServerTransport.handleSaslStartMessage(TSaslServerTransport.java:125)
> at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)