Jens-G opened a new pull request, #3873:
URL: https://github.com/apache/thrift/pull/3873

   JIRA: [THRIFT-6281](https://issues.apache.org/jira/browse/THRIFT-6281)
   Client: go
   
   `TFramedTransport.Flush` checked a frame against `math.MaxUint32` only. 
`readFrame` refuses a frame larger than the configured `MaxFrameSize` (default 
16384000), but `Flush` wrote such frames. Measured on master with 
`MaxFrameSize: 1024`: `Flush` of a 2048-byte frame returned nil and wrote 2052 
bytes, and a `TFramedTransport` with the same configuration refused that frame 
with "Incorrect frame size (2048)".
   
   This is the plain framed counterpart of #3860 (THRIFT-6262), which does the 
same for `THeaderTransport`.
   
   ### Change
   
   - `Flush` applies `GetMaxFrameSize()`. A larger frame is refused with a 
`TTransportException`, like the existing checks in this file, and nothing of it 
is written.
   - `GetMaxFrameSize()` never exceeds `math.MaxInt32`, so the new check also 
covers the old `MaxUint32` one.
   - The `defer` that returns the write buffer now runs before the check, so a 
refused frame is dropped. The next `Write`/`Flush` starts from an empty buffer 
rather than failing again on the same oversized one.
   - `lib/go/README.md` gets a note for clients that send frames larger than 
the default. The note sits before the TLS section, so it does not collide with 
the one #3860 appends.
   
   ### Compatibility
   
   A client that writes frames larger than its own `MaxFrameSize` now gets an 
error from `Flush` instead of sending a frame that a peer with the same 
configuration refuses.
   
   ### Tests
   
   New `TestTFramedTransportFlushFrameSizeLimit`:
   - **At the limit:** a frame of exactly the limit is written and read back.
   - **One byte over:** `Flush` returns a `TTransportException` and writes 0 
bytes. The next small frame then goes out on its own, 4 + 4 bytes.
   
   Results:
   - **Unmodified library:** the over-limit case fails, because `Flush` 
returned nil.
   - **Mutations:** each fails one assertion:
     - `>` → `>=`;
     - removing the check;
     - moving the buffer release back behind the check.
   - **Checks:** `go vet -stdmethods=false` and `go test -race ./thrift` pass 
with Go 1.26 and 1.27, and `GOARCH=386` vet and tests pass as well.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to