Skip to content

enforce stringLengthLimit in TCompactProtocol.readBinary#3605

Open
dxbjavid wants to merge 1 commit into
apache:masterfrom
dxbjavid:compact-binary-length-limit
Open

enforce stringLengthLimit in TCompactProtocol.readBinary#3605
dxbjavid wants to merge 1 commit into
apache:masterfrom
dxbjavid:compact-binary-length-limit

Conversation

@dxbjavid

Copy link
Copy Markdown
Contributor

TCompactProtocol.readBinary only checks the binary length against the remaining message budget, so the per-string limit (stringLengthLimit) that readString applies through checkStringReadLength is never enforced for binary fields. a peer that has configured a string length limit therefore has it quietly bypassed for any binary value, which can then be sized up to the whole message. routing readBinary through checkStringReadLength applies the same limit and keeps the existing remaining-bytes check, matching how TBinaryProtocol.readBinary already behaves. added a regression test alongside the existing compact string-limit test.

  • Did you create an Apache Jira ticket? (Request account here, not required for trivial changes)
  • If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
  • Did you squash your changes to a single commit? (not required, but preferred)
  • Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
  • If your change does not involve any code, include [skip ci] anywhere in the commit message to free up build resources.

@dxbjavid dxbjavid requested review from fishy and jimexist as code owners June 23, 2026 14:29
@mergeable mergeable Bot added the java Pull requests that update Java code label Jun 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant