Sylwester Lachiewicz

Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic

Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)

Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back

Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)

Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound