Jens Geyer created THRIFT-6253:
----------------------------------
Summary: Python: THeaderTransport raises struct.error when a
header frame is shorter than four bytes
Key: THRIFT-6253
URL: https://issues.apache.org/jira/browse/THRIFT-6253
Project: Thrift
Issue Type: Bug
Components: Python - Library
Reporter: Jens Geyer
{{THeaderTransport.readFrame()}} in
{{lib/py/src/transport/THeaderTransport.py}} bounds the declared frame size
from above but not from below:
{code:python}
if frame_size > self._max_frame_size:
raise TTransportException(TTransportException.SIZE_LIMIT, "Frame was too
large.")
read_buffer = BytesIO(self._transport.readAll(frame_size))
second_word = read_buffer.read(I32.size)
version, = I32.unpack(second_word)
{code}
Every frame carries a four-byte word after the length, so a frame that declares
fewer than four bytes leaves {{read_buffer.read(4)}} short and {{I32.unpack}}
raises {{struct.error}} ({{unpack requires a buffer of 4 bytes}}) instead of a
{{TTransportException}}. A caller that handles the transport's own exception
type sees an unrelated exception escape.
The C++ transport rejects the same sizes explicitly, in
{{THeaderTransport::readFrame()}}:
{code:cpp}
if (sz < sizeof(magic_n)) {
throw TTransportException(TTransportException::CORRUPTED_DATA,
"Header transport frame is too small");
}
{code}
h2. Suggested fix
Reject a declared frame size below four bytes in {{readFrame()}} with a
{{TTransportException}}, next to the existing upper bound. The header-format
branch, which needs ten bytes, may want its own check the way C++ has one.
_Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
