Jens GeyerandClaude Opus 5.5 38e890bf5c Bound the varint length in the PHP compact protocol's readI64 ...

Client: php

TCompactProtocol::readI64() decodes its varint in a loop of its own, apart
from readVarint(), and kept reading continuation bytes for as long as the
transport delivered them. It now stops after MAX_VARINT_BYTES, as
readVarint() does, and throws TProtocolException INVALID_DATA for a longer
varint. Two unit tests cover the limit and the longest valid encoding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-28 01:32:42 +01:00

..

Integration

Bound string and binary lengths on the PHP inlined read path

2026-10-21 00:05:15 +02:00

Resources

THRIFT-6047: Limit struct/union/exception read/write recursion depth in PHP library

2026-06-03 23:11:30 +02:00

Unit/Lib

Bound the varint length in the PHP compact protocol's readI64

2026-10-28 01:32:42 +01:00

bootstrap.php

Count the recursion depth on the inlined read path

2026-09-23 00:54:06 +02:00

Makefile.am

Count the recursion depth on the inlined read path

2026-09-23 00:54:06 +02:00