Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #671 +/- ##
==========================================
+ Coverage 56.14% 61.59% +5.45%
==========================================
Files 166 167 +1
Lines 22517 22606 +89
==========================================
+ Hits 12642 13924 +1282
+ Misses 9875 8682 -1193 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
shenyj3
force-pushed
the
fix/multiservice-unsafe-codec-gating
branch
from
September 15, 2026 04:03
639321d to
9944cda
Compare
The raw-bytes service impl generated by volo-build for Router-based multi-service servers unconditionally decoded requests with TBinaryUnsafeInputProtocol, whose read primitives use get_unchecked without bounds checks. A truncated binary frame from any peer could trigger an out-of-bounds heap read (debug: abort; release: silent OOB), bypassing the unsafe-codec feature that guards the single-service path. Move encode/decode into volo-thrift helpers that select the safe TBinaryProtocol by default and the unsafe variants only when the unsafe-codec feature is enabled, matching the hand-written codec. Add a regression test that sends a truncated frame and verifies the server survives and keeps serving.
shenyj3
force-pushed
the
fix/multiservice-unsafe-codec-gating
branch
from
September 15, 2026 11:53
9944cda to
cdbd4bc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TBinaryUnsafeInputProtocol, whose read primitives useget_uncheckedwithout bounds checks.unsafe-codecfeature that guards the single-service codec incodec/default/thrift.rs.volo_thrift::codec::default::multiservicehelpers that use the safeTBinaryProtocolby default and the unsafe variants only behindunsafe-codec; the compact path is unchanged.Test plan
cargo check -p volo-thriftwith default features and--features unsafe-codeccargo check --workspace --offlinethrift_multi_service_malformed: truncated framed binary frame against a Router server; the default safe codec survives (debug + release) and a subsequent normal request succeeds--features volo-thrift/unsafe-codecaborts at pilotabinary_unsafe.rsprecondition, confirming the test hits the fix pointthrift_multi_servicetests pass; fmt + clippy clean