[THRIFT-2272] CLONE - Denial of Service attack in TBinaryProtocol.readString

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Incomplete
• Affects Version/s: 0.6.1, 0.8
• Fix Version/s: 0.9
• Component/s: Java - Library
• Labels: security

Environment

All

• Assignee: Niraj Tolia
• Reporter: Valentin Mayamsin
• Created: 25/Nov/13 17:58
• Updated: 21/Feb/14 15:44
• Resolved: 21/Feb/14 15:44

Description

In readString, if the string field's size is greater than the number of bytes remaining in the byte array to deserialize, libthrift will happily allocate a byte array of that size in readStringBody, filling the heap.

Issue Links

• is a clone of: THRIFT-1643 Denial of Service attack in TBinaryProtocol.readString