| commit | 435e1c4f70bd5216676a7cded0448fb8bc564989 | [log] [tgz] |
|---|---|---|
| author | Jake Farrell <jfarrell@apache.org> | Fri Oct 12 00:43:13 2012 +0000 |
| committer | Jake Farrell <jfarrell@apache.org> | Fri Oct 12 00:43:13 2012 +0000 |
| tree | e0d256b669a1994e404175e9e1320548a2d8f36c | |
| parent | 6fcecd45a715c02452af6674f44e8edb6b0a2f42 [diff] |
THRIFT-1643:Denial of Service attack in TBinaryProtocol.readString Client: java Patch: Niraj Tolia In readString, if the string field's size is greater than the number of bytes remaining in the byte array to deserialize, libthrift will happily allocate a byte array of that size in readStringBody, filling the heap. git-svn-id: https://svn.apache.org/repos/asf/thrift/trunk@1397397 13f79535-47bb-0310-9956-ffa450edef68