thrift 0.23.0 → 0.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97c9f50f4cf15be35eb546b5762d7625e3c2b3f8b97765217962409ba66acb99
-  data.tar.gz: 92ebb46420c41a9aaa1db0a78cbb7e513d43898c3064283a0b521d4037e63d22
+  metadata.gz: 0eacf1574da356dba55962561224cd683bf1c073e531b8402f469e91cb964dd8
+  data.tar.gz: b7f8aed51a240fab797e8137d56bd65c25d04291b292be40b3475831b945d4f5
 SHA512:
-  metadata.gz: 4d5bcb6f79e7625989ff71e4693de7a0ba19babddb01c7727f4820343947af84ee0fef2a916d836c6a8343a4516670fae8af8f7a35bf8b3c94ab001000615baf
-  data.tar.gz: 6216728eb0196480044992e42c8896f82d6e84314aa530bcc438ee50fa636d690a8bd9196868312cc70263ac3e53f99887001cd3073577573baf63f95142f504
+  metadata.gz: 35f22ce7f4d25a25c18611548eaf575a33a62bdd3a673876ac36fa783ccb44bd7b0066ebf2b1158ad6687aaf49182a9af2a9f6c1955addcf71e8c7738f615a66
+  data.tar.gz: 0edd8cdaccb60eb0082da2aed7169f46b167ef821d68ba126c22945738165d20bca3a505fb09969c8abb5dccd212ea23d296ffcc02c2b6e46a29d361e925efcf

data/README.md

@@ -27,7 +27,7 @@ clients and services.
 
 ## Compatibility
 
-- Ruby MRI >= 2.7 (tested against current supported releases).
+- Ruby MRI >= 3.0 (tested against current supported releases).
 - JRuby works with the pure-Ruby implementation; the native extension is
   skipped automatically.
 - For the repo-wide transport, protocol, and server support matrix, see
@@ -36,7 +36,7 @@ clients and services.
 
 ## Installation
 
-- Requirements: Ruby >= 2.7.
+- Requirements: Ruby >= 3.0.
 - From RubyGems: `gem install thrift`
 - From source: `bundle install`, `gem build thrift.gemspec`, then install the
   resulting `thrift-*.gem`. The native accelerator is built when the gem is
@@ -47,49 +47,80 @@ clients and services.
 The Ruby library does not include the Thrift compiler. Use a compiler built
 from the root of this repository to generate Ruby bindings:
 
-    thrift --gen rb path/to/service.thrift
-    # with namespaced modules
-    thrift --gen rb:namespaced --recurse path/to/service.thrift
+```bash
+thrift --gen rb path/to/service.thrift
+# with namespaced modules
+thrift --gen rb:namespaced --recurse path/to/service.thrift
+```
 
 Generated files are typically written to `gen-rb/` and can be required
 directly from your application.
 
 ## Basic Client Usage
 
-    $:.push File.expand_path('gen-rb', __dir__)
-    require 'thrift'
-    require 'calculator'
+```ruby
+$:.push File.expand_path('gen-rb', __dir__)
+require 'thrift'
+require 'calculator'
 
-    socket     = Thrift::Socket.new('localhost', 9090)
-    transport  = Thrift::BufferedTransport.new(socket)
-    protocol   = Thrift::BinaryProtocol.new(transport)
-    client     = Calculator::Client.new(protocol)
+socket     = Thrift::Socket.new('localhost', 9090)
+transport  = Thrift::BufferedTransport.new(socket)
+protocol   = Thrift::BinaryProtocol.new(transport)
+client     = Calculator::Client.new(protocol)
 
-    transport.open
-    puts client.add(1, 1)
-    transport.close
+transport.open
+puts client.add(1, 1)
+transport.close
+```
 
 ## Basic Server Usage
 
-    $:.push File.expand_path('gen-rb', __dir__)
-    require 'thrift'
-    require 'calculator'
-
-    class CalculatorHandler
-      def add(a, b)
-        a + b
-      end
-    end
-
-    handler            = CalculatorHandler.new
-    processor          = Calculator::Processor.new(handler)
-    server_transport   = Thrift::ServerSocket.new(9090)
-    transport_factory  = Thrift::BufferedTransportFactory.new
-    protocol_factory   = Thrift::BinaryProtocolFactory.new
-
-    server = Thrift::ThreadedServer.new(processor, server_transport,
-                                        transport_factory, protocol_factory)
-    server.serve
+```ruby
+$:.push File.expand_path('gen-rb', __dir__)
+require 'thrift'
+require 'calculator'
+
+class CalculatorHandler
+  def add(a, b)
+    a + b
+  end
+end
+
+handler            = CalculatorHandler.new
+processor          = Calculator::Processor.new(handler)
+server_transport   = Thrift::ServerSocket.new(9090)
+transport_factory  = Thrift::BufferedTransportFactory.new
+protocol_factory   = Thrift::BinaryProtocolFactory.new
+
+server = Thrift::ThreadedServer.new(processor, server_transport,
+                                    transport_factory, protocol_factory)
+server.serve
+```
+
+## Rack HTTP Endpoint
+
+Ruby HTTP transport can be mounted as a Rack application, so applications can
+run Thrift on an existing Rack server such as Puma or Falcon.
+The examples below use the generated `Calculator::Processor` and the
+`CalculatorHandler` from [Basic Server Usage](#basic-server-usage).
+
+```ruby
+# config.ru
+require 'thrift'
+require 'thrift/server/rack_application'
+
+processor = Calculator::Processor.new(CalculatorHandler.new)
+run Thrift::RackApplication.new(processor)
+```
+
+For Rails or another Rack router, mount the endpoint at the route that should
+receive Thrift HTTP requests:
+
+```ruby
+# config/routes.rb
+processor = Calculator::Processor.new(CalculatorHandler.new)
+mount Thrift::RackApplication.new(processor) => "/thrift"
+```
 
 ## Development and Tests
 
@@ -111,6 +142,109 @@ directly from your application.
 
 ## Breaking Changes
 
+### 0.25.0
+
+Ruby 2.7 support has been removed because the runtime reached end of life on
+March 31, 2023. The Thrift gem now requires Ruby 3.0 or newer. Applications
+still running Ruby 2.7 must upgrade Ruby before installing Thrift 0.25.0 or
+remain on an earlier Thrift release.
+
+Ruby HTTP servers now share one Rack endpoint. Run `Thrift::RackApplication`
+as a Rack app, or mount it at one path in an app such as Rails. The
+cross-language HTTP tests now cover Puma and Falcon.
+
+`Thrift::MongrelHTTPServer` has been removed because Mongrel no longer works
+with supported Ruby versions. To migrate, mount `Thrift::RackApplication` in
+a supported Rack server. See [Rack HTTP Endpoint](#rack-http-endpoint).
+
+`Thrift::ThinHTTPServer` is deprecated because Thin is no longer maintained.
+Its EventMachine dependency also does not build on new Ruby development
+versions. Creating a Thin server now prints a warning. Move to
+`Thrift::RackApplication` with a supported Rack server such as Puma or Falcon.
+
+`Thrift::SSLSocket` now verifies peers by default when no SSL context is
+provided. It creates a context that uses the system certificate store. A
+supplied SSL context is not reconfigured by Thrift, so the application is
+responsible for its verification mode and trust sources. A newly constructed
+`OpenSSL::SSL::SSLContext` defaults to `OpenSSL::SSL::VERIFY_NONE`; configuring
+a trust source alone does not enable certificate chain verification. The server
+certificate must still match the connection hostname.
+
+`Thrift::NonblockingServer` now closes a connection whose frame declares more than
+`max_frame_size` before it collects the frame. `max_frame_size` is a new keyword argument
+and defaults to `Thrift::FramedTransport::DEFAULT_MAX_FRAME_SIZE` (16,384,000 bytes), the
+limit `FramedTransport` already applies to the frame the worker reads back. A server that
+accepted larger frames must pass a higher `max_frame_size:` to keep doing so.
+
+`Thrift::Socket#open` now raises
+`Thrift::TransportException::ALREADY_OPEN` when the TCP transport is already
+open. Close the transport before opening it again.
+
+Ruby struct, union, and exception serialization methods now accept an optional
+remaining struct depth: `read(protocol, depth = 64)` and
+`write(protocol, depth = 64)`.
+Unknown and mismatched fields remain independently bounded by
+`Thrift::BaseProtocol#skip`. The `write_field` and `write_type` helpers accept
+an optional `remaining_depth`: custom writers must use
+`write_field(field_info, fid, value, remaining_depth)` or
+`write_type(field_info, value, remaining_depth)` for struct values. Custom
+protocols and custom struct, union, or exception serialization overrides with
+exact argument counts must accept and forward the optional depth argument (or
+use `*args`) before upgrading.
+
+`Thrift::BinaryProtocol`, `Thrift::BinaryProtocolAccelerated` and `Thrift::CompactProtocol`
+now refuse a string or binary field longer than `max_string_size` before reading it,
+with a `ProtocolException` of type `SIZE_LIMIT`. The maximum defaults to
+`Thrift::BaseProtocol::DEFAULT_MAX_STRING_SIZE`, 16384000 bytes, the frame size limit
+the framed transports apply, and is a keyword argument of the three protocols and
+their factories. Pass `max_string_size: nil` to read strings of any length, as before.
+
+### 0.24.0
+
+Connect timeout handling changed for both `Thrift::Socket` and
+`Thrift::SSLSocket`.
+
+- `timeout == nil` and `timeout == 0` now use blocking connect/open semantics.
+  Older releases already treated `nil` that way, but treated `0` differently
+  across operations: `read` and `write` used the blocking path, plain TCP
+  `open` used a zero-length poll, and TLS `open` could spin in the handshake
+  retry loop.
+- Positive timeouts now bound the whole connect/open operation instead of
+  effectively applying a fresh timeout window at each wait or address attempt.
+  For plain TCP this budget is shared across address fallback. For TLS it is
+  shared across the TCP connect and the SSL handshake.
+- Connect/open timeout expiry now raises
+  `Thrift::TransportException::TIMED_OUT`. Older releases could report the same
+  condition as `NOT_OPEN`, and `Thrift::SSLSocket` could keep retrying the
+  handshake after the wait timed out.
+
+If your application matched `NOT_OPEN` for connect timeout handling, update it
+to handle `TIMED_OUT`. If you relied on `timeout = 0` meaning immediate failure
+or on repeated retries extending the effective timeout during TCP fallback or
+TLS handshake, update those call paths before upgrading.
+
+Ruby server socket transports now apply a 5-second timeout to accepted client
+sockets by default. This prevents stalled clients from blocking server threads
+indefinitely during response writes. Applications that intentionally require
+blocking accepted sockets can pass `client_timeout: nil` or `client_timeout: 0`
+when constructing `Thrift::ServerSocket`, `Thrift::SSLServerSocket`, or
+`Thrift::UNIXServerSocket`.
+
+Generated Ruby structs and unions now suffix field ID constants as
+`*_FIELD_ID` instead of exposing bare uppercased field names. For example,
+`MyStruct::FOO` becomes `MyStruct::FOO_FIELD_ID`. This avoids collisions with
+the generated `FIELDS` metadata hash for field names such as `fields`, but it
+is a source-compatible break if your application referenced the old constants
+directly. Regenerate Ruby code and update those constant references atomically.
+
+Ruby binary protocol writers now enforce signed Thrift integer ranges before
+serializing values. `byte`, `i16`, `i32`, and `i64` writes reject values outside
+their declared signed ranges, and binary/string/container sizes must fit in a
+non-negative signed `i32` length. Older releases could silently wrap or clip
+some out-of-range values, such as writing `255` as a byte that read back as
+`-1`. This applies to both `Thrift::BinaryProtocol` and
+`Thrift::BinaryProtocolAccelerated`.
+
 ### 0.23.0
 
 The documented source-build flow now effectively requires Ruby `2.7+`.
@@ -157,14 +291,30 @@ best-effort, not guaranteed.
   `thrift --gen rb` and namespaced output from `thrift --gen rb:namespaced`
   use different require paths, so switch them atomically with regenerated code.
 
-      # --gen rb
-      require 'calculator'
+  ```ruby
+  # --gen rb
+  require 'calculator'
 
-      # --gen rb:namespaced
-      require 'my_namespace/calculator'
+  # --gen rb:namespaced
+  require 'my_namespace/calculator'
+  ```
 
 ## Migration Notes
 
+- If you upgrade to `0.25.0`, note that `Thrift::SSLSocket` now verifies peers
+  by default when it creates the SSL context. Supplied contexts are used
+  unchanged and must configure their own verification mode and trust sources.
+  A blank supplied context defaults to `OpenSSL::SSL::VERIFY_NONE`. Hostname
+  checking is performed for both supplied and default contexts.
+- If you upgrade to `0.25.0`, close a `Thrift::Socket` before calling `open`
+  again. A duplicate open now raises
+  `Thrift::TransportException::ALREADY_OPEN`.
+- If you upgrade to `0.24.0`, treat `timeout` on `Thrift::Socket` and
+  `Thrift::SSLSocket` as one budget for the whole open path. For
+  `Thrift::SSLSocket`, that includes both the TCP connect and the TLS
+  handshake.
+- If you upgrade to `0.24.0`, handle connect/open timeout expiry as
+  `Thrift::TransportException::TIMED_OUT` instead of `NOT_OPEN`.
 - If you upgrade across the stricter reply-validation changes, regenerate all
   Ruby stubs and deploy them with the matching Ruby runtime. Do not mix old
   generated code, new generated code, and new runtime code on the same client
@@ -197,5 +347,18 @@ best-effort, not guaranteed.
 - Client and server must agree on transport and protocol choices. If you
   switch to SSL, HTTP, header transport, compact protocol, or namespaced
   generated code, update both ends together.
-- HTTPS client transport verifies peers by default, and `Thrift::SSLSocket`
-  performs a hostname check against the host you pass in.
+- HTTPS client transport and `Thrift::SSLSocket` verify peers by default.
+  When no SSL context is provided, `Thrift::SSLSocket` creates one with peer
+  verification and the system certificate store. Thrift passes a supplied
+  context to OpenSSL without reconfiguring it. `Thrift::SSLSocket` always
+  checks the certificate against `server_hostname` (or the connection host by
+  default). `OpenSSL::SSL::SSLContext.new` defaults to
+  `OpenSSL::SSL::VERIFY_NONE`, and setting `ca_file`, `ca_path`, or `cert_store`
+  does not enable verification by itself. Set `verify_mode` explicitly when
+  supplying a context. For example, to disable certificate chain verification:
+
+  ```ruby
+  context = OpenSSL::SSL::SSLContext.new
+  context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+  socket = Thrift::SSLSocket.new(host, port, nil, context)
+  ```

data/ext/binary_protocol_accelerated.c

@@ -31,13 +31,59 @@ VALUE rb_thrift_binary_proto_native_qmark(VALUE self) {
   return Qtrue;
 }
 
-
-
 static int VERSION_1;
 static int VERSION_MASK;
 static int TYPE_MASK;
 static ID rbuf_ivar_id;
 
+static int64_t checked_integer_value(VALUE value) {
+  if (!RB_INTEGER_TYPE_P(value)) {
+    rb_raise(rb_eTypeError, "integer argument expected");
+  }
+
+  return NUM2LL(value);
+}
+
+static int64_t checked_integer_range(VALUE value, int64_t min, int64_t max) {
+  int64_t integer = checked_integer_value(value);
+
+  if (integer < min || integer > max) {
+    rb_raise(rb_eRangeError, "integer out of bounds");
+  }
+
+  return integer;
+}
+
+static int8_t checked_byte_value(VALUE value) {
+  return (int8_t)checked_integer_range(value, INT8_MIN, INT8_MAX);
+}
+
+static int16_t checked_i16_value(VALUE value) {
+  return (int16_t)checked_integer_range(value, INT16_MIN, INT16_MAX);
+}
+
+static int32_t checked_i32_value(VALUE value) {
+  return (int32_t)checked_integer_range(value, INT32_MIN, INT32_MAX);
+}
+
+static int32_t checked_size_value(VALUE value) {
+  return (int32_t)checked_integer_range(value, 0, INT32_MAX);
+}
+
+static int64_t checked_i64_value(VALUE value) {
+  return checked_integer_range(value, INT64_MIN, INT64_MAX);
+}
+
+static int32_t checked_string_length(VALUE str) {
+  long length = RSTRING_LEN(str);
+
+  if (length > INT32_MAX) {
+    rb_raise(rb_eRangeError, "string too long");
+  }
+
+  return (int32_t)length;
+}
+
 static void write_byte_direct(VALUE trans, int8_t b) {
   WRITE(trans, (char*)&b, 1);
 }
@@ -83,7 +129,7 @@ static void write_string_direct(VALUE trans, VALUE str) {
     rb_raise(rb_eStandardError, "Value should be a string");
   }
   str = convert_to_utf8_byte_buffer(str);
-  write_i32_direct(trans, (int32_t)RSTRING_LEN(str));
+  write_i32_direct(trans, checked_string_length(str));
   rb_funcall(trans, write_method_id, 1, str);
 }
 
@@ -124,13 +170,14 @@ VALUE rb_thrift_binary_proto_write_message_begin(VALUE self, VALUE name, VALUE t
   VALUE strict_write = GET_STRICT_WRITE(self);
 
   if (strict_write == Qtrue) {
-    write_i32_direct(trans, VERSION_1 | FIX2INT(type));
+    int8_t message_type = checked_byte_value(type);
+    write_i32_direct(trans, VERSION_1 | message_type);
     write_string_direct(trans, name);
-    write_i32_direct(trans, FIX2INT(seqid));
+    write_i32_direct(trans, checked_i32_value(seqid));
   } else {
     write_string_direct(trans, name);
-    write_byte_direct(trans, FIX2INT(type));
-    write_i32_direct(trans, FIX2INT(seqid));
+    write_byte_direct(trans, checked_byte_value(type));
+    write_i32_direct(trans, checked_i32_value(seqid));
   }
 
   return Qnil;
@@ -138,8 +185,8 @@ VALUE rb_thrift_binary_proto_write_message_begin(VALUE self, VALUE name, VALUE t
 
 VALUE rb_thrift_binary_proto_write_field_begin(VALUE self, VALUE name, VALUE type, VALUE id) {
   VALUE trans = GET_TRANSPORT(self);
-  write_byte_direct(trans, FIX2INT(type));
-  write_i16_direct(trans, FIX2INT(id));
+  write_byte_direct(trans, checked_byte_value(type));
+  write_i16_direct(trans, checked_i16_value(id));
 
   return Qnil;
 }
@@ -151,17 +198,17 @@ VALUE rb_thrift_binary_proto_write_field_stop(VALUE self) {
 
 VALUE rb_thrift_binary_proto_write_map_begin(VALUE self, VALUE ktype, VALUE vtype, VALUE size) {
   VALUE trans = GET_TRANSPORT(self);
-  write_byte_direct(trans, FIX2INT(ktype));
-  write_byte_direct(trans, FIX2INT(vtype));
-  write_i32_direct(trans, FIX2INT(size));
+  write_byte_direct(trans, checked_byte_value(ktype));
+  write_byte_direct(trans, checked_byte_value(vtype));
+  write_i32_direct(trans, checked_size_value(size));
 
   return Qnil;
 }
 
 VALUE rb_thrift_binary_proto_write_list_begin(VALUE self, VALUE etype, VALUE size) {
   VALUE trans = GET_TRANSPORT(self);
-  write_byte_direct(trans, FIX2INT(etype));
-  write_i32_direct(trans, FIX2INT(size));
+  write_byte_direct(trans, checked_byte_value(etype));
+  write_i32_direct(trans, checked_size_value(size));
 
   return Qnil;
 }
@@ -178,25 +225,25 @@ VALUE rb_thrift_binary_proto_write_bool(VALUE self, VALUE b) {
 
 VALUE rb_thrift_binary_proto_write_byte(VALUE self, VALUE byte) {
   CHECK_NIL(byte);
-  write_byte_direct(GET_TRANSPORT(self), NUM2INT(byte));
+  write_byte_direct(GET_TRANSPORT(self), checked_byte_value(byte));
   return Qnil;
 }
 
 VALUE rb_thrift_binary_proto_write_i16(VALUE self, VALUE i16) {
   CHECK_NIL(i16);
-  write_i16_direct(GET_TRANSPORT(self), FIX2INT(i16));
+  write_i16_direct(GET_TRANSPORT(self), checked_i16_value(i16));
   return Qnil;
 }
 
 VALUE rb_thrift_binary_proto_write_i32(VALUE self, VALUE i32) {
   CHECK_NIL(i32);
-  write_i32_direct(GET_TRANSPORT(self), NUM2INT(i32));
+  write_i32_direct(GET_TRANSPORT(self), checked_i32_value(i32));
   return Qnil;
 }
 
 VALUE rb_thrift_binary_proto_write_i64(VALUE self, VALUE i64) {
   CHECK_NIL(i64);
-  write_i64_direct(GET_TRANSPORT(self), NUM2LL(i64));
+  write_i64_direct(GET_TRANSPORT(self), checked_i64_value(i64));
   return Qnil;
 }
 
@@ -224,7 +271,7 @@ VALUE rb_thrift_binary_proto_write_binary(VALUE self, VALUE buf) {
   CHECK_NIL(buf);
   VALUE trans = GET_TRANSPORT(self);
   buf = force_binary_encoding(buf);
-  write_i32_direct(trans, (int32_t)RSTRING_LEN(buf));
+  write_i32_direct(trans, checked_string_length(buf));
   rb_funcall(trans, write_method_id, 1, buf);
   return Qnil;
 }
@@ -284,33 +331,62 @@ static char read_byte_direct(VALUE self) {
   return (char)(FIX2INT(byte));
 }
 
+static int16_t uint16_to_int16(uint16_t value) {
+  if (value <= INT16_MAX) {
+    return (int16_t)value;
+  }
+  return (int16_t)((int32_t)value - ((int32_t)UINT16_MAX + 1));
+}
+
+static int32_t uint32_to_int32(uint32_t value) {
+  if (value <= INT32_MAX) {
+    return (int32_t)value;
+  }
+  return (int32_t)((int64_t)value - (INT64_C(1) << 32));
+}
+
+static int64_t uint64_to_int64(uint64_t value) {
+  if (value <= INT64_MAX) {
+    return (int64_t)value;
+  }
+  return -(int64_t)(~value) - INT64_C(1);
+}
+
 static int16_t read_i16_direct(VALUE self) {
   VALUE rbuf = rb_ivar_get(self, rbuf_ivar_id);
   rb_funcall(GET_TRANSPORT(self), read_into_buffer_method_id, 2, rbuf, INT2FIX(2));
-  return (int16_t)(((uint8_t)(RSTRING_PTR(rbuf)[1])) | ((uint16_t)((RSTRING_PTR(rbuf)[0]) << 8)));
+  const uint8_t* bytes = (const uint8_t*)RSTRING_PTR(rbuf);
+  uint16_t value = ((uint16_t)bytes[0] << 8) | (uint16_t)bytes[1];
+  return uint16_to_int16(value);
 }
 
 static int32_t read_i32_direct(VALUE self) {
   VALUE rbuf = rb_ivar_get(self, rbuf_ivar_id);
   rb_funcall(GET_TRANSPORT(self), read_into_buffer_method_id, 2, rbuf, INT2FIX(4));
-  return ((uint8_t)(RSTRING_PTR(rbuf)[3])) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[2])) << 8) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[1])) << 16) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[0])) << 24);
+  const uint8_t* bytes = (const uint8_t*)RSTRING_PTR(rbuf);
+  uint32_t value = ((uint32_t)bytes[0] << 24) |
+    ((uint32_t)bytes[1] << 16) |
+    ((uint32_t)bytes[2] << 8) |
+    (uint32_t)bytes[3];
+  return uint32_to_int32(value);
 }
 
-static int64_t read_i64_direct(VALUE self) {
+static uint64_t read_u64_direct(VALUE self) {
   VALUE rbuf = rb_ivar_get(self, rbuf_ivar_id);
   rb_funcall(GET_TRANSPORT(self), read_into_buffer_method_id, 2, rbuf, INT2FIX(8));
-  uint64_t hi = ((uint8_t)(RSTRING_PTR(rbuf)[3])) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[2])) << 8) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[1])) << 16) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[0])) << 24);
-  uint32_t lo = ((uint8_t)(RSTRING_PTR(rbuf)[7])) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[6])) << 8) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[5])) << 16) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[4])) << 24);
-  return (hi << 32) | lo;
+  const uint8_t* bytes = (const uint8_t*)RSTRING_PTR(rbuf);
+  return ((uint64_t)bytes[0] << 56) |
+    ((uint64_t)bytes[1] << 48) |
+    ((uint64_t)bytes[2] << 40) |
+    ((uint64_t)bytes[3] << 32) |
+    ((uint64_t)bytes[4] << 24) |
+    ((uint64_t)bytes[5] << 16) |
+    ((uint64_t)bytes[6] << 8) |
+    (uint64_t)bytes[7];
+}
+
+static int64_t read_i64_direct(VALUE self) {
+  return uint64_to_int64(read_u64_direct(self));
 }
 
 VALUE rb_thrift_binary_proto_read_message_end(VALUE self) {
@@ -346,6 +422,10 @@ VALUE rb_thrift_binary_proto_read_message_begin(VALUE self) {
   VALUE name, seqid;
   int type;
 
+  if (RTEST(rb_ivar_get(self, reset_message_size_ivar_id))) {
+    rb_funcall(GET_TRANSPORT(self), reset_message_size_method_id, 0);
+  }
+
   int version = read_i32_direct(self);
 
   if (version < 0) {
@@ -359,6 +439,7 @@ VALUE rb_thrift_binary_proto_read_message_begin(VALUE self) {
     if (strict_read == Qtrue) {
       rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_BAD_VERSION), rb_str_new2("No version identifier, old protocol client?")));
     }
+    CHECK_STRING_SIZE(self, version);
     name = READ(self, version);
     type = read_byte_direct(self);
     seqid = rb_thrift_binary_proto_read_i32(self);
@@ -377,17 +458,24 @@ VALUE rb_thrift_binary_proto_read_field_begin(VALUE self) {
   }
 }
 
+#define CHECK_NEGATIVE_SIZE(size) \
+  if (RB_UNLIKELY((size) < 0)) { \
+    rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_NEGATIVE_SIZE), rb_str_new2("Negative size"))); \
+  }
+
 VALUE rb_thrift_binary_proto_read_map_begin(VALUE self) {
   VALUE ktype = rb_thrift_binary_proto_read_byte(self);
   VALUE vtype = rb_thrift_binary_proto_read_byte(self);
-  VALUE size = rb_thrift_binary_proto_read_i32(self);
-  return rb_ary_new3(3, ktype, vtype, size);
+  int size = read_i32_direct(self);
+  CHECK_NEGATIVE_SIZE(size);
+  return rb_ary_new3(3, ktype, vtype, INT2NUM(size));
 }
 
 VALUE rb_thrift_binary_proto_read_list_begin(VALUE self) {
   VALUE etype = rb_thrift_binary_proto_read_byte(self);
-  VALUE size = rb_thrift_binary_proto_read_i32(self);
-  return rb_ary_new3(2, etype, size);
+  int size = read_i32_direct(self);
+  CHECK_NEGATIVE_SIZE(size);
+  return rb_ary_new3(2, etype, INT2NUM(size));
 }
 
 VALUE rb_thrift_binary_proto_read_set_begin(VALUE self) {
@@ -418,9 +506,9 @@ VALUE rb_thrift_binary_proto_read_i64(VALUE self) {
 VALUE rb_thrift_binary_proto_read_double(VALUE self) {
   union {
     double f;
-    int64_t t;
+    uint64_t t;
   } transfer;
-  transfer.t = read_i64_direct(self);
+  transfer.t = read_u64_direct(self);
   return rb_float_new(transfer.f);
 }
 
@@ -431,6 +519,8 @@ VALUE rb_thrift_binary_proto_read_string(VALUE self) {
 
 VALUE rb_thrift_binary_proto_read_binary(VALUE self) {
   int size = read_i32_direct(self);
+  CHECK_NEGATIVE_SIZE(size);
+  CHECK_STRING_SIZE(self, size);
   return READ(self, size);
 }
 

data/ext/bytes.c

@@ -24,6 +24,20 @@
 #include <constants.h>
 
 VALUE force_binary_encoding(VALUE buffer) {
+  if (RB_TYPE_P(buffer, T_STRING)) {
+    if (rb_enc_get_index(buffer) == rb_ascii8bit_encindex()) {
+      return buffer;
+    }
+
+    if (RB_OBJ_FROZEN(buffer)) {
+      buffer = rb_obj_dup(buffer);
+    }
+
+    rb_enc_associate_index(buffer, rb_ascii8bit_encindex());
+
+    return buffer;
+  }
+
   return rb_funcall(thrift_bytes_module, force_binary_encoding_id, 1, buffer);
 }