Jens Geyer created THRIFT-6261:
----------------------------------
Summary: PHP: TCompactProtocol accepts a negative container size
where TBinaryProtocol rejects it
Key: THRIFT-6261
URL: https://issues.apache.org/jira/browse/THRIFT-6261
Project: Thrift
Issue Type: Bug
Components: PHP - Library
Reporter: Jens Geyer
{{lib/php/lib/Protocol/TBinaryProtocol.php}} rejects a container size below
zero in {{readMapBegin()}}, {{readListBegin()}} and {{readSetBegin()}}:
{code:php}
if ($size < 0) {
throw new TProtocolException('Negative size',
TProtocolException::NEGATIVE_SIZE);
}
{code}
{{lib/php/lib/Protocol/TCompactProtocol.php}} has no such check.
{{readMapBegin()}} ({{:519}}) takes its size straight from {{readVarint()}},
and {{readCollectionBegin()}} ({{:504}}), which serves both {{readListBegin()}}
and {{readSetBegin()}}, does the same for the long form:
{code:php}
$size = $sizeType >> 4;
$type = $this->getTType($sizeType);
if ($size == 15) {
$result += $this->readVarint($size);
}
{code}
The size then reaches the generated {{read()}} loops, which run {{for ($i = 0;
$i < $size; ...)}} -- so a negative value silently yields an empty container
instead of the protocol error the binary protocol raises for the same input.
The two protocols should answer the same input the same way.
h2. Suggested fix
Add the {{NEGATIVE_SIZE}} check to {{readMapBegin()}} and
{{readCollectionBegin()}}, worded as in {{TBinaryProtocol}}.
_Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
