diff options
| author | Andreas Krennmair <andreas@fraugster.com> | 2022-04-20 13:20:12 +0200 |
|---|---|---|
| committer | Jens Geyer <Jens-G@users.noreply.github.com> | 2022-04-20 23:28:55 +0200 |
| commit | 8987820e84ac26392293ab40480cf8f2971fb314 (patch) | |
| tree | 51a2388779e780a3eac8a5872e36c880e16838a6 | |
| parent | edcad983d9896adc559f7305549492db85629f4c (diff) | |
| download | thrift-8987820e84ac26392293ab40480cf8f2971fb314.tar.gz | |
THRIFT-5569: add negative size checks in Go generator when reading maps, sets and lists
Client: go
| -rw-r--r-- | compiler/cpp/src/thrift/generate/t_go_generator.cc | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/compiler/cpp/src/thrift/generate/t_go_generator.cc b/compiler/cpp/src/thrift/generate/t_go_generator.cc index 3b885f103..020297b9b 100644 --- a/compiler/cpp/src/thrift/generate/t_go_generator.cc +++ b/compiler/cpp/src/thrift/generate/t_go_generator.cc @@ -3369,6 +3369,9 @@ void t_go_generator::generate_deserialize_container(ostream& out, // Declare variables, read header if (ttype->is_map()) { out << indent() << "_, _, size, err := iprot.ReadMapBegin(ctx)" << endl; + out << indent() << "if size < 0 {" << endl; + out << indent() << " return errors.New(\"map size is negative\")" << endl; + out << indent() << "}" << endl; out << indent() << "if err != nil {" << endl; out << indent() << " return thrift.PrependError(\"error reading map begin: \", err)" << endl; out << indent() << "}" << endl; @@ -3376,6 +3379,9 @@ void t_go_generator::generate_deserialize_container(ostream& out, out << indent() << prefix << eq << " " << (pointer_field ? "&" : "") << "tMap" << endl; } else if (ttype->is_set()) { out << indent() << "_, size, err := iprot.ReadSetBegin(ctx)" << endl; + out << indent() << "if size < 0 {" << endl; + out << indent() << " return errors.New(\"set size is negative\")" << endl; + out << indent() << "}" << endl; out << indent() << "if err != nil {" << endl; out << indent() << " return thrift.PrependError(\"error reading set begin: \", err)" << endl; out << indent() << "}" << endl; @@ -3383,6 +3389,9 @@ void t_go_generator::generate_deserialize_container(ostream& out, out << indent() << prefix << eq << " " << (pointer_field ? "&" : "") << "tSet" << endl; } else if (ttype->is_list()) { out << indent() << "_, size, err := iprot.ReadListBegin(ctx)" << endl; + out << indent() << "if size < 0 {" << endl; + out << indent() << " return errors.New(\"list size is negative\")" << endl; + out << indent() << "}" << endl; out << indent() << "if err != nil {" << endl; out << indent() << " return thrift.PrependError(\"error reading list begin: \", err)" << endl; out << indent() << "}" << endl; |