thrift/CVE-2019-0210.patch
2021-01-12 14:17:45 +08:00

80 lines
2.7 KiB
Diff

From 264a3f318ed3e9e51573f67f963c8509786bcec2 Mon Sep 17 00:00:00 2001
From: Jens Geyer <jensg@apache.org>
Date: Sat, 23 Feb 2019 13:11:40 +0100
Subject: [PATCH] additional test for TSimpleJSONProtocol
---
lib/go/thrift/json_protocol.go | 5 +----
lib/go/thrift/simple_json_protocol.go | 4 ++--
lib/go/thrift/simple_json_protocol_test.go | 22 ++++++++++++++++++++++
3 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/lib/go/thrift/json_protocol.go b/lib/go/thrift/json_protocol.go
index 7be685d43f..800ac22c7b 100644
--- a/lib/go/thrift/json_protocol.go
+++ b/lib/go/thrift/json_protocol.go
@@ -31,10 +31,7 @@ const (
// for references to _ParseContext see tsimplejson_protocol.go
// JSON protocol implementation for thrift.
-//
-// This protocol produces/consumes a simple output format
-// suitable for parsing by scripting languages. It should not be
-// confused with the full-featured TJSONProtocol.
+// Utilizes Simple JSON protocol
//
type TJSONProtocol struct {
*TSimpleJSONProtocol
diff --git a/lib/go/thrift/simple_json_protocol.go b/lib/go/thrift/simple_json_protocol.go
index 2e8a71112a..f5e0c05d18 100644
--- a/lib/go/thrift/simple_json_protocol.go
+++ b/lib/go/thrift/simple_json_protocol.go
@@ -59,7 +59,7 @@ func (p _ParseContext) String() string {
return "UNKNOWN-PARSE-CONTEXT"
}
-// JSON protocol implementation for thrift.
+// Simple JSON protocol implementation for thrift.
//
// This protocol produces/consumes a simple output format
// suitable for parsing by scripting languages. It should not be
@@ -1316,7 +1316,7 @@ func (p *TSimpleJSONProtocol) readNumeric() (Numeric, error) {
func (p *TSimpleJSONProtocol) safePeekContains(b []byte) bool {
for i := 0; i < len(b); i++ {
a, _ := p.reader.Peek(i + 1)
- if len(a) == 0 || a[i] != b[i] {
+ if len(a) < (i+1) || a[i] != b[i] {
return false
}
}
diff --git a/lib/go/thrift/simple_json_protocol_test.go b/lib/go/thrift/simple_json_protocol_test.go
index 7b98082a4e..0126da0a8e 100644
--- a/lib/go/thrift/simple_json_protocol_test.go
+++ b/lib/go/thrift/simple_json_protocol_test.go
@@ -713,3 +713,25 @@ func TestWriteSimpleJSONProtocolMap(t *testing.T) {
}
trans.Close()
}
+
+func TestWriteSimpleJSONProtocolSafePeek(t *testing.T) {
+ trans := NewTMemoryBuffer()
+ p := NewTSimpleJSONProtocol(trans)
+ trans.Write([]byte{'a', 'b'})
+ trans.Flush(context.Background())
+
+ test1 := p.safePeekContains([]byte{'a', 'b'})
+ if !test1 {
+ t.Fatalf("Should match at test 1")
+ }
+
+ test2 := p.safePeekContains([]byte{'a', 'b', 'c', 'd'})
+ if test2 {
+ t.Fatalf("Should not match at test 2")
+ }
+
+ test3 := p.safePeekContains([]byte{'x', 'y'})
+ if test3 {
+ t.Fatalf("Should not match at test 3")
+ }
+}