[THRIFT-1205] port server unduly fragile with arbitrary input

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.6.1
• Fix Version/s: 0.8
• Component/s: Java - Library
• Labels: security

Environment

javac 1.5.0_19, OS X 10.4.11

• Patch Info: Patch Available
• Assignee: Ryan King
• Reporter: Toby Thain
• Created: 15/Jun/11 02:40
• Updated: 11/Aug/11 19:39
• Resolved: 11/Aug/11 18:54

Description

Telnetting to the port and type a couple of arbitrary characters crashes the server almost immediately as follows. I haven't glanced at the relevant code. Is this reproducible on other platforms?

$ ./run-server.sh 
Starting the simple server...
Exception in thread "Thread-0" java.lang.OutOfMemoryError: Java heap space
        at org.apache.thrift.protocol.TBinaryProtocol.readStringBody(TBinaryProtocol.java:353)
        at org.apache.thrift.protocol.TBinaryProtocol.readMessageBegin(TBinaryProtocol.java:215)
        at SimonSays$Processor.process(Unknown Source)
        at org.apache.thrift.server.TSimpleServer.serve(TSimpleServer.java:70)
        at JavaServer.simple(Unknown Source)
        at JavaServer$1.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:613)