[jira] [Resolved] (THRIFT-6133) Ruby native MemoryBufferTransport handles oversized reads consistently

["Dmytro Shteflyuk (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/THRIFT-6133?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Dmytro Shteflyuk resolved THRIFT-6133.
--------------------------------------
    Fix Version/s: 0.25.0
       Resolution: Fixed

> Ruby native MemoryBufferTransport handles oversized reads consistently
> ----------------------------------------------------------------------
>
>                 Key: THRIFT-6133
>                 URL: https://issues.apache.org/jira/browse/THRIFT-6133
>             Project: Thrift
>          Issue Type: Bug
>          Components: Ruby - Library
>            Reporter: Dmytro Shteflyuk
>            Assignee: Dmytro Shteflyuk
>            Priority: Major
>             Fix For: 0.25.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> h3. Problem
> The native implementation of {{MemoryBufferTransport#read_all}} converts the requested length to a C {{int}} before comparing it with the bytes available. A positive Compact string length above {{INT_MAX}} therefore raises Ruby {{RangeError}} instead of the read failure emitted by pure Ruby.
> h3. Client impact
> Ruby clients using native {{MemoryBufferTransport}} observe a Ruby implementation exception for a truncated oversized read, whereas pure Ruby reports {{EOFError}}. Parser fuzzing treats {{EOFError}} as malformed input and exits on this inconsistent exception.
> h3. Reproduction
> {code:sh}
> bundle exec rake build_ext
> bundle exec ruby -Ilib -e 'require "thrift"; Thrift::MemoryBufferTransport.new("x").read_all(3_397_380_576)'
> {code}
> Testing on master commit {{f69c2078b7c11c09aa4f8b8879d8b41342145461}} produces:
> {code}
> -e:1:in 'Thrift::MemoryBufferTransport#read_all': integer 3397380576 too big to convert to 'int' (RangeError)
> {code}
> h3. Expected behavior
> A positive length that exceeds the bytes available from a {{MemoryBufferTransport}} raises {{EOFError}} in both native and pure Ruby. Invalid negative lengths continue to raise the existing Thrift transport exception.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)