Skip to content

Reject a message the protocol did not name in the c_glib multiplexed processor - #3678

Merged
Jens-G merged 1 commit into
apache:masterfrom
Jens-G:cglib-multiplexed-name-handling
Jul 28, 2026
Merged

Reject a message the protocol did not name in the c_glib multiplexed processor#3678
Jens-G merged 1 commit into
apache:masterfrom
Jens-G:cglib-multiplexed-name-handling

Conversation

@Jens-G

@Jens-G Jens-G commented Jul 27, 2026

Copy link
Copy Markdown
Member

thrift_multiplexed_processor_process_impl passed the method name straight to
strtok_r as soon as read_message_begin reported success:

for (token = strtok_r(fname, THRIFT_MULTIPLEXED_PROTOCOL_DEFAULT_SEPARATOR, &state), ...

A protocol that reports success without writing the name leaves fname NULL,
and strtok_r then continues from its saved state pointer, which starts out
NULL as well. The name is also used further down to build the error text for an
unregistered service and the header of the exception reply.

thrift_stored_message_protocol_read_message_begin returns success with
*name = g_strdup (self->name), so a stored-message protocol constructed
without a name produces exactly that input. The binary and compact protocols
always allocate a name on success, so this does not arise from the protocols
the multiplexed processor is normally driven with.

This mirrors what thrift_dispatch_processor.c — the file this code is copied
from, as the comment at line 183 notes — already does since f9c5925: a
message the protocol did not name is rejected rather than dispatched.

Change

Reject the message right after the header read, before the message-type check,
matching the order the dispatch processor uses. The existing
THRIFT_MULTIPLEXED_PROCESSOR_ERROR_MESSAGE_WRONGLY_MULTIPLEXED code is reused
so no value is added to the public header.

Tests

testmultiplexedprocessor.c gains MessageWithoutName, driving the processor
with a stub protocol that reports success for the header without naming the
method. Against the unpatched processor the case terminates the test binary
with SIGSEGV; with the change it asserts the error domain and code.

Verified on both build systems:

  • CMake: full c_glib suite, 39/39 passing
  • Autotools: bootstrap.sh / configure / make, all four
    testmultiplexedprocessor cases passing
  • Clean under G_DEBUG=fatal-warnings, no new compiler warnings

No build-file changes — the test file is already registered in CMakeLists.txt
and Makefile.am.

Generated-by: Claude Opus 5 (1M context)

🤖 Generated with Claude Code

…processor

Client: c_glib

thrift_multiplexed_processor_process_impl handed the method name straight to
strtok_r once read_message_begin reported success. A protocol that reports
success without writing the name leaves that pointer NULL, and strtok_r reads
through its saved state pointer, which starts out NULL as well. The name is
also used to build the error text and the reply header further down.

Reject a message the protocol did not name, the way the dispatch processor
this code was copied from already does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@Jens-G
Jens-G requested a review from mhlakhani as a code owner July 27, 2026 23:59
@mergeable mergeable Bot added the c_glib label Jul 27, 2026
@Jens-G
Jens-G merged commit 4e9e407 into apache:master Jul 28, 2026
95 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant