This is an automated email from the ASF dual-hosted git repository.
jensg pushed a commit to branch 0.23.0
in repository https://gitbox.apache.org/repos/asf/thrift.git
The following commit(s) were added to refs/heads/0.23.0 by this push:
new 58286988c added int range checks
58286988c is described below
commit 58286988c4b82a8ac0f7b9850c7370ac56fe4652
Author: Jens Geyer <[email protected]>
AuthorDate: Wed Apr 8 23:06:45 2026 +0200
added int range checks
---
lib/go/thrift/framed_transport.go | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/lib/go/thrift/framed_transport.go
b/lib/go/thrift/framed_transport.go
index e3c323afc..00f277e18 100644
--- a/lib/go/thrift/framed_transport.go
+++ b/lib/go/thrift/framed_transport.go
@@ -26,6 +26,7 @@ import (
"encoding/binary"
"fmt"
"io"
+ "math"
)
// Deprecated: Use DEFAULT_MAX_FRAME_SIZE instead.
@@ -60,8 +61,13 @@ func NewTFramedTransportFactory(factory TTransportFactory)
TTransportFactory {
// Deprecated: Use NewTFramedTransportFactoryConf instead.
func NewTFramedTransportFactoryMaxLength(factory TTransportFactory, maxLength
uint32) TTransportFactory {
+ safeMax := maxLength
+ if safeMax > math.MaxInt32 {
+ safeMax = math.MaxInt32
+ }
+
return NewTFramedTransportFactoryConf(factory, &TConfiguration{
- MaxFrameSize: int32(maxLength),
+ MaxFrameSize: int32(safeMax),
noPropagation: true,
})
@@ -196,8 +202,12 @@ func (p *TFramedTransport) WriteString(s string) (n int,
err error) {
}
func (p *TFramedTransport) Flush(ctx context.Context) error {
- defer bufPool.put(&p.writeBuf)
size := p.writeBuf.Len()
+ if size > math.MaxUint32 {
+ return NewTTransportException(UNKNOWN_TRANSPORT_EXCEPTION,
fmt.Sprintf("frame too large: %d bytes exceeds uint32 max",size))
+ }
+
+ defer bufPool.put(&p.writeBuf)
buf := p.buffer[:4]
binary.BigEndian.PutUint32(buf, uint32(size))
_, err := p.transport.Write(buf)
