thrift 0.24.0 → 0.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90306a751b8d883922c4556778391d56c8c48fbf008187d3edfe411db4e9f6f7
-  data.tar.gz: 95287ba8714521389775a7d2ad265b3ad60a3ca44ada102abcf0c2ee152347cd
+  metadata.gz: 0eacf1574da356dba55962561224cd683bf1c073e531b8402f469e91cb964dd8
+  data.tar.gz: b7f8aed51a240fab797e8137d56bd65c25d04291b292be40b3475831b945d4f5
 SHA512:
-  metadata.gz: d7e052575e5b7e581440a9073d2f4c6ce828b79963f7ce5c077f77e7c759b3589d5671a9e6f37ff4df996061af6b77362cc6248c7d22ac414156594b3fd77339
-  data.tar.gz: 35f5ee1d30099e5c70fa49d420153442e2b0b97587a908dea86ad1f9a2bbc44df5ff1baa3474cbc48f4064e20571eab7aa00c5fb155202f05edcd17579cbaddf
+  metadata.gz: 35f22ce7f4d25a25c18611548eaf575a33a62bdd3a673876ac36fa783ccb44bd7b0066ebf2b1158ad6687aaf49182a9af2a9f6c1955addcf71e8c7738f615a66
+  data.tar.gz: 0edd8cdaccb60eb0082da2aed7169f46b167ef821d68ba126c22945738165d20bca3a505fb09969c8abb5dccd212ea23d296ffcc02c2b6e46a29d361e925efcf

data/README.md

@@ -27,7 +27,7 @@ clients and services.
 
 ## Compatibility
 
-- Ruby MRI >= 2.7 (tested against current supported releases).
+- Ruby MRI >= 3.0 (tested against current supported releases).
 - JRuby works with the pure-Ruby implementation; the native extension is
   skipped automatically.
 - For the repo-wide transport, protocol, and server support matrix, see
@@ -36,7 +36,7 @@ clients and services.
 
 ## Installation
 
-- Requirements: Ruby >= 2.7.
+- Requirements: Ruby >= 3.0.
 - From RubyGems: `gem install thrift`
 - From source: `bundle install`, `gem build thrift.gemspec`, then install the
   resulting `thrift-*.gem`. The native accelerator is built when the gem is
@@ -97,6 +97,31 @@ server = Thrift::ThreadedServer.new(processor, server_transport,
 server.serve
 ```
 
+## Rack HTTP Endpoint
+
+Ruby HTTP transport can be mounted as a Rack application, so applications can
+run Thrift on an existing Rack server such as Puma or Falcon.
+The examples below use the generated `Calculator::Processor` and the
+`CalculatorHandler` from [Basic Server Usage](#basic-server-usage).
+
+```ruby
+# config.ru
+require 'thrift'
+require 'thrift/server/rack_application'
+
+processor = Calculator::Processor.new(CalculatorHandler.new)
+run Thrift::RackApplication.new(processor)
+```
+
+For Rails or another Rack router, mount the endpoint at the route that should
+receive Thrift HTTP requests:
+
+```ruby
+# config/routes.rb
+processor = Calculator::Processor.new(CalculatorHandler.new)
+mount Thrift::RackApplication.new(processor) => "/thrift"
+```
+
 ## Development and Tests
 
 - `bundle exec rake spec` runs the Ruby specs. It expects a built Thrift
@@ -117,6 +142,63 @@ server.serve
 
 ## Breaking Changes
 
+### 0.25.0
+
+Ruby 2.7 support has been removed because the runtime reached end of life on
+March 31, 2023. The Thrift gem now requires Ruby 3.0 or newer. Applications
+still running Ruby 2.7 must upgrade Ruby before installing Thrift 0.25.0 or
+remain on an earlier Thrift release.
+
+Ruby HTTP servers now share one Rack endpoint. Run `Thrift::RackApplication`
+as a Rack app, or mount it at one path in an app such as Rails. The
+cross-language HTTP tests now cover Puma and Falcon.
+
+`Thrift::MongrelHTTPServer` has been removed because Mongrel no longer works
+with supported Ruby versions. To migrate, mount `Thrift::RackApplication` in
+a supported Rack server. See [Rack HTTP Endpoint](#rack-http-endpoint).
+
+`Thrift::ThinHTTPServer` is deprecated because Thin is no longer maintained.
+Its EventMachine dependency also does not build on new Ruby development
+versions. Creating a Thin server now prints a warning. Move to
+`Thrift::RackApplication` with a supported Rack server such as Puma or Falcon.
+
+`Thrift::SSLSocket` now verifies peers by default when no SSL context is
+provided. It creates a context that uses the system certificate store. A
+supplied SSL context is not reconfigured by Thrift, so the application is
+responsible for its verification mode and trust sources. A newly constructed
+`OpenSSL::SSL::SSLContext` defaults to `OpenSSL::SSL::VERIFY_NONE`; configuring
+a trust source alone does not enable certificate chain verification. The server
+certificate must still match the connection hostname.
+
+`Thrift::NonblockingServer` now closes a connection whose frame declares more than
+`max_frame_size` before it collects the frame. `max_frame_size` is a new keyword argument
+and defaults to `Thrift::FramedTransport::DEFAULT_MAX_FRAME_SIZE` (16,384,000 bytes), the
+limit `FramedTransport` already applies to the frame the worker reads back. A server that
+accepted larger frames must pass a higher `max_frame_size:` to keep doing so.
+
+`Thrift::Socket#open` now raises
+`Thrift::TransportException::ALREADY_OPEN` when the TCP transport is already
+open. Close the transport before opening it again.
+
+Ruby struct, union, and exception serialization methods now accept an optional
+remaining struct depth: `read(protocol, depth = 64)` and
+`write(protocol, depth = 64)`.
+Unknown and mismatched fields remain independently bounded by
+`Thrift::BaseProtocol#skip`. The `write_field` and `write_type` helpers accept
+an optional `remaining_depth`: custom writers must use
+`write_field(field_info, fid, value, remaining_depth)` or
+`write_type(field_info, value, remaining_depth)` for struct values. Custom
+protocols and custom struct, union, or exception serialization overrides with
+exact argument counts must accept and forward the optional depth argument (or
+use `*args`) before upgrading.
+
+`Thrift::BinaryProtocol`, `Thrift::BinaryProtocolAccelerated` and `Thrift::CompactProtocol`
+now refuse a string or binary field longer than `max_string_size` before reading it,
+with a `ProtocolException` of type `SIZE_LIMIT`. The maximum defaults to
+`Thrift::BaseProtocol::DEFAULT_MAX_STRING_SIZE`, 16384000 bytes, the frame size limit
+the framed transports apply, and is a keyword argument of the three protocols and
+their factories. Pass `max_string_size: nil` to read strings of any length, as before.
+
 ### 0.24.0
 
 Connect timeout handling changed for both `Thrift::Socket` and
@@ -219,6 +301,14 @@ best-effort, not guaranteed.
 
 ## Migration Notes
 
+- If you upgrade to `0.25.0`, note that `Thrift::SSLSocket` now verifies peers
+  by default when it creates the SSL context. Supplied contexts are used
+  unchanged and must configure their own verification mode and trust sources.
+  A blank supplied context defaults to `OpenSSL::SSL::VERIFY_NONE`. Hostname
+  checking is performed for both supplied and default contexts.
+- If you upgrade to `0.25.0`, close a `Thrift::Socket` before calling `open`
+  again. A duplicate open now raises
+  `Thrift::TransportException::ALREADY_OPEN`.
 - If you upgrade to `0.24.0`, treat `timeout` on `Thrift::Socket` and
   `Thrift::SSLSocket` as one budget for the whole open path. For
   `Thrift::SSLSocket`, that includes both the TCP connect and the TLS
@@ -257,5 +347,18 @@ best-effort, not guaranteed.
 - Client and server must agree on transport and protocol choices. If you
   switch to SSL, HTTP, header transport, compact protocol, or namespaced
   generated code, update both ends together.
-- HTTPS client transport verifies peers by default, and `Thrift::SSLSocket`
-  performs a hostname check against the host you pass in.
+- HTTPS client transport and `Thrift::SSLSocket` verify peers by default.
+  When no SSL context is provided, `Thrift::SSLSocket` creates one with peer
+  verification and the system certificate store. Thrift passes a supplied
+  context to OpenSSL without reconfiguring it. `Thrift::SSLSocket` always
+  checks the certificate against `server_hostname` (or the connection host by
+  default). `OpenSSL::SSL::SSLContext.new` defaults to
+  `OpenSSL::SSL::VERIFY_NONE`, and setting `ca_file`, `ca_path`, or `cert_store`
+  does not enable verification by itself. Set `verify_mode` explicitly when
+  supplying a context. For example, to disable certificate chain verification:
+
+  ```ruby
+  context = OpenSSL::SSL::SSLContext.new
+  context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+  socket = Thrift::SSLSocket.new(host, port, nil, context)
+  ```

data/ext/binary_protocol_accelerated.c

@@ -331,33 +331,62 @@ static char read_byte_direct(VALUE self) {
   return (char)(FIX2INT(byte));
 }
 
+static int16_t uint16_to_int16(uint16_t value) {
+  if (value <= INT16_MAX) {
+    return (int16_t)value;
+  }
+  return (int16_t)((int32_t)value - ((int32_t)UINT16_MAX + 1));
+}
+
+static int32_t uint32_to_int32(uint32_t value) {
+  if (value <= INT32_MAX) {
+    return (int32_t)value;
+  }
+  return (int32_t)((int64_t)value - (INT64_C(1) << 32));
+}
+
+static int64_t uint64_to_int64(uint64_t value) {
+  if (value <= INT64_MAX) {
+    return (int64_t)value;
+  }
+  return -(int64_t)(~value) - INT64_C(1);
+}
+
 static int16_t read_i16_direct(VALUE self) {
   VALUE rbuf = rb_ivar_get(self, rbuf_ivar_id);
   rb_funcall(GET_TRANSPORT(self), read_into_buffer_method_id, 2, rbuf, INT2FIX(2));
-  return (int16_t)(((uint8_t)(RSTRING_PTR(rbuf)[1])) | ((uint16_t)((RSTRING_PTR(rbuf)[0]) << 8)));
+  const uint8_t* bytes = (const uint8_t*)RSTRING_PTR(rbuf);
+  uint16_t value = ((uint16_t)bytes[0] << 8) | (uint16_t)bytes[1];
+  return uint16_to_int16(value);
 }
 
 static int32_t read_i32_direct(VALUE self) {
   VALUE rbuf = rb_ivar_get(self, rbuf_ivar_id);
   rb_funcall(GET_TRANSPORT(self), read_into_buffer_method_id, 2, rbuf, INT2FIX(4));
-  return ((uint8_t)(RSTRING_PTR(rbuf)[3])) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[2])) << 8) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[1])) << 16) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[0])) << 24);
+  const uint8_t* bytes = (const uint8_t*)RSTRING_PTR(rbuf);
+  uint32_t value = ((uint32_t)bytes[0] << 24) |
+    ((uint32_t)bytes[1] << 16) |
+    ((uint32_t)bytes[2] << 8) |
+    (uint32_t)bytes[3];
+  return uint32_to_int32(value);
 }
 
-static int64_t read_i64_direct(VALUE self) {
+static uint64_t read_u64_direct(VALUE self) {
   VALUE rbuf = rb_ivar_get(self, rbuf_ivar_id);
   rb_funcall(GET_TRANSPORT(self), read_into_buffer_method_id, 2, rbuf, INT2FIX(8));
-  uint64_t hi = ((uint8_t)(RSTRING_PTR(rbuf)[3])) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[2])) << 8) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[1])) << 16) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[0])) << 24);
-  uint32_t lo = ((uint8_t)(RSTRING_PTR(rbuf)[7])) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[6])) << 8) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[5])) << 16) |
-    (((uint8_t)(RSTRING_PTR(rbuf)[4])) << 24);
-  return (hi << 32) | lo;
+  const uint8_t* bytes = (const uint8_t*)RSTRING_PTR(rbuf);
+  return ((uint64_t)bytes[0] << 56) |
+    ((uint64_t)bytes[1] << 48) |
+    ((uint64_t)bytes[2] << 40) |
+    ((uint64_t)bytes[3] << 32) |
+    ((uint64_t)bytes[4] << 24) |
+    ((uint64_t)bytes[5] << 16) |
+    ((uint64_t)bytes[6] << 8) |
+    (uint64_t)bytes[7];
+}
+
+static int64_t read_i64_direct(VALUE self) {
+  return uint64_to_int64(read_u64_direct(self));
 }
 
 VALUE rb_thrift_binary_proto_read_message_end(VALUE self) {
@@ -393,6 +422,10 @@ VALUE rb_thrift_binary_proto_read_message_begin(VALUE self) {
   VALUE name, seqid;
   int type;
 
+  if (RTEST(rb_ivar_get(self, reset_message_size_ivar_id))) {
+    rb_funcall(GET_TRANSPORT(self), reset_message_size_method_id, 0);
+  }
+
   int version = read_i32_direct(self);
 
   if (version < 0) {
@@ -406,6 +439,7 @@ VALUE rb_thrift_binary_proto_read_message_begin(VALUE self) {
     if (strict_read == Qtrue) {
       rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_BAD_VERSION), rb_str_new2("No version identifier, old protocol client?")));
     }
+    CHECK_STRING_SIZE(self, version);
     name = READ(self, version);
     type = read_byte_direct(self);
     seqid = rb_thrift_binary_proto_read_i32(self);
@@ -472,9 +506,9 @@ VALUE rb_thrift_binary_proto_read_i64(VALUE self) {
 VALUE rb_thrift_binary_proto_read_double(VALUE self) {
   union {
     double f;
-    int64_t t;
+    uint64_t t;
   } transfer;
-  transfer.t = read_i64_direct(self);
+  transfer.t = read_u64_direct(self);
   return rb_float_new(transfer.f);
 }
 
@@ -486,6 +520,7 @@ VALUE rb_thrift_binary_proto_read_string(VALUE self) {
 VALUE rb_thrift_binary_proto_read_binary(VALUE self) {
   int size = read_i32_direct(self);
   CHECK_NEGATIVE_SIZE(size);
+  CHECK_STRING_SIZE(self, size);
   return READ(self, size);
 }
 

data/ext/compact_protocol.c

@@ -62,9 +62,43 @@ static int CTYPE_MAP            = 0x0B;
 static int CTYPE_STRUCT         = 0x0C;
 static int CTYPE_UUID           = 0x0D;
 
-VALUE rb_thrift_compact_proto_write_i16(VALUE self, VALUE i16);
+static uint32_t int_to_zig_zag(int32_t n);
+static void write_varint32(VALUE transport, uint32_t n);
+
+static int64_t checked_integer_range(VALUE value, int64_t min, int64_t max) {
+  CHECK_NIL(value);
+  if (RB_UNLIKELY(!RB_INTEGER_TYPE_P(value))) {
+    rb_raise(rb_eTypeError, "integer argument expected");
+  }
+
+  int64_t integer = NUM2LL(value);
+  if (RB_UNLIKELY(integer < min || integer > max)) {
+    rb_raise(rb_eRangeError, "integer out of bounds");
+  }
+
+  return integer;
+}
+
+static int8_t checked_byte_value(VALUE value) {
+  return (int8_t)checked_integer_range(value, INT8_MIN, INT8_MAX);
+}
+
+static int16_t checked_i16_value(VALUE value) {
+  return (int16_t)checked_integer_range(value, INT16_MIN, INT16_MAX);
+}
+
+static int32_t checked_i32_value(VALUE value) {
+  return (int32_t)checked_integer_range(value, INT32_MIN, INT32_MAX);
+}
+
+static int32_t checked_size_value(VALUE value) {
+  return (int32_t)checked_integer_range(value, 0, INT32_MAX);
+}
+
+static int64_t checked_i64_value(VALUE value) {
+  return checked_integer_range(value, INT64_MIN, INT64_MAX);
+}
 
-// TODO: implement this
 static int get_compact_type(VALUE type_value) {
   int type = FIX2INT(type_value);
   if (type == TTYPE_BOOL) {
@@ -92,10 +126,11 @@ static int get_compact_type(VALUE type_value) {
   } else if (type == TTYPE_UUID) {
     return CTYPE_UUID;
   } else {
-    char str[50];
-    sprintf(str, "don't know what type: %d", type);
-    rb_raise(rb_eStandardError, "%s", str);
-    return 0;
+    rb_exc_raise(get_protocol_exception(
+      INT2FIX(PROTOERR_INVALID_DATA),
+      rb_sprintf("Unknown compact type: %d", type)
+    ));
+    return 0; /* unreachable */
   }
 }
 
@@ -103,13 +138,11 @@ static void write_byte_direct(VALUE transport, int8_t b) {
   WRITE(transport, (char*)&b, 1);
 }
 
-static void write_field_begin_internal(VALUE self, VALUE type, VALUE id_value, VALUE type_override) {
-  int id = FIX2INT(id_value);
+static void write_field_begin_internal(VALUE self, VALUE type, int16_t id, int8_t type_override) {
+  int8_t type_to_write = type_override == 0 ? get_compact_type(type) : type_override;
   int last_id = LAST_ID(self);
   VALUE transport = GET_TRANSPORT(self);
 
-  // if there's a type override, use that.
-  int8_t type_to_write = RTEST(type_override) ? FIX2INT(type_override) : get_compact_type(type);
   // check if we can use delta encoding for the field id
   int diff = id - last_id;
   if (diff > 0 && diff <= 15) {
@@ -118,10 +151,10 @@ static void write_field_begin_internal(VALUE self, VALUE type, VALUE id_value, V
   } else {
     // write them separate
     write_byte_direct(transport, type_to_write & 0x0f);
-    rb_thrift_compact_proto_write_i16(self, id_value);
+    write_varint32(transport, int_to_zig_zag(id));
   }
 
-  SET_LAST_ID(self, id_value);
+  SET_LAST_ID(self, INT2FIX(id));
 }
 
 static uint32_t int_to_zig_zag(int32_t n) {
@@ -141,35 +174,38 @@ static int32_t message_seqid_from_varint32(uint32_t seqid) {
 }
 
 static void write_varint32(VALUE transport, uint32_t n) {
-  while (true) {
-    if ((n & ~0x7FU) == 0U) {
-      write_byte_direct(transport, n & 0x7FU);
-      break;
-    } else {
-      write_byte_direct(transport, (n & 0x7FU) | 0x80U);
-      n = n >> 7;
-    }
+  unsigned char bytes[5];
+  long length = 0;
+
+  while ((n & ~0x7FU) != 0U) {
+    bytes[length++] = (n & 0x7FU) | 0x80U;
+    n >>= 7;
   }
+  bytes[length++] = n;
+
+  WRITE(transport, (const char*)bytes, length);
 }
 
 static void write_varint64(VALUE transport, uint64_t n) {
-  while (true) {
-    if ((n & ~0x7FULL) == 0ULL) {
-      write_byte_direct(transport, n & 0x7FULL);
-      break;
-    } else {
-      write_byte_direct(transport, (n & 0x7FULL) | 0x80ULL);
-      n = n >> 7;
-    }
+  unsigned char bytes[10];
+  long length = 0;
+
+  while ((n & ~0x7FULL) != 0ULL) {
+    bytes[length++] = (n & 0x7FULL) | 0x80ULL;
+    n >>= 7;
   }
+  bytes[length++] = n;
+
+  WRITE(transport, (const char*)bytes, length);
 }
 
 static void write_collection_begin(VALUE transport, VALUE elem_type, VALUE size_value) {
-  int size = FIX2INT(size_value);
+  int size = checked_size_value(size_value);
+  int compact_type = get_compact_type(elem_type);
   if (size <= 14) {
-    write_byte_direct(transport, size << 4 | get_compact_type(elem_type));
+    write_byte_direct(transport, size << 4 | compact_type);
   } else {
-    write_byte_direct(transport, 0xf0 | get_compact_type(elem_type));
+    write_byte_direct(transport, 0xf0 | compact_type);
     write_varint32(transport, size);
   }
 }
@@ -216,9 +252,10 @@ VALUE rb_thrift_compact_proto_write_set_end(VALUE self) {
 
 VALUE rb_thrift_compact_proto_write_message_begin(VALUE self, VALUE name, VALUE type, VALUE seqid) {
   VALUE transport = GET_TRANSPORT(self);
-  int32_t seqid_value = FIX2INT(seqid);
+  uint32_t type_value = (uint32_t)FIX2INT(type);
+  int32_t seqid_value = checked_i32_value(seqid);
   write_byte_direct(transport, PROTOCOL_ID);
-  write_byte_direct(transport, (VERSION & VERSION_MASK) | ((FIX2INT(type) << TYPE_SHIFT_AMOUNT) & TYPE_MASK));
+  write_byte_direct(transport, (VERSION & VERSION_MASK) | ((type_value << TYPE_SHIFT_AMOUNT) & TYPE_MASK));
   write_varint32(transport, message_seqid_to_varint32(seqid_value));
   rb_thrift_compact_proto_write_string(self, name);
 
@@ -226,11 +263,12 @@ VALUE rb_thrift_compact_proto_write_message_begin(VALUE self, VALUE name, VALUE
 }
 
 VALUE rb_thrift_compact_proto_write_field_begin(VALUE self, VALUE name, VALUE type, VALUE id) {
+  int16_t field_id = checked_i16_value(id);
   if (FIX2INT(type) == TTYPE_BOOL) {
     // we want to possibly include the value, so we'll wait.
-    rb_ivar_set(self, boolean_field_id, rb_ary_new3(2, type, id));
+    rb_ivar_set(self, boolean_field_id, rb_ary_new3(2, type, INT2FIX(field_id)));
   } else {
-    write_field_begin_internal(self, type, id, Qnil);
+    write_field_begin_internal(self, type, field_id, 0);
   }
 
   return Qnil;
@@ -242,7 +280,7 @@ VALUE rb_thrift_compact_proto_write_field_stop(VALUE self) {
 }
 
 VALUE rb_thrift_compact_proto_write_map_begin(VALUE self, VALUE ktype, VALUE vtype, VALUE size_value) {
-  int size = FIX2INT(size_value);
+  int size = checked_size_value(size_value);
   VALUE transport = GET_TRANSPORT(self);
   if (size == 0) {
     write_byte_direct(transport, 0);
@@ -264,39 +302,36 @@ VALUE rb_thrift_compact_proto_write_set_begin(VALUE self, VALUE etype, VALUE siz
 }
 
 VALUE rb_thrift_compact_proto_write_bool(VALUE self, VALUE b) {
-  int8_t type = b == Qtrue ? CTYPE_BOOLEAN_TRUE : CTYPE_BOOLEAN_FALSE;
+  int8_t type = RTEST(b) ? CTYPE_BOOLEAN_TRUE : CTYPE_BOOLEAN_FALSE;
   VALUE boolean_field = rb_ivar_get(self, boolean_field_id);
   if (NIL_P(boolean_field)) {
     // we're not part of a field, so just write the value.
     write_byte_direct(GET_TRANSPORT(self), type);
   } else {
     // we haven't written the field header yet
-    write_field_begin_internal(self, rb_ary_entry(boolean_field, 0), rb_ary_entry(boolean_field, 1), INT2FIX(type));
+    write_field_begin_internal(self, rb_ary_entry(boolean_field, 0), FIX2INT(rb_ary_entry(boolean_field, 1)), type);
     rb_ivar_set(self, boolean_field_id, Qnil);
   }
   return Qnil;
 }
 
 VALUE rb_thrift_compact_proto_write_byte(VALUE self, VALUE byte) {
-  CHECK_NIL(byte);
-  write_byte_direct(GET_TRANSPORT(self), FIX2INT(byte));
+  write_byte_direct(GET_TRANSPORT(self), checked_byte_value(byte));
   return Qnil;
 }
 
 VALUE rb_thrift_compact_proto_write_i16(VALUE self, VALUE i16) {
-  rb_thrift_compact_proto_write_i32(self, i16);
+  write_varint32(GET_TRANSPORT(self), int_to_zig_zag(checked_i16_value(i16)));
   return Qnil;
 }
 
 VALUE rb_thrift_compact_proto_write_i32(VALUE self, VALUE i32) {
-  CHECK_NIL(i32);
-  write_varint32(GET_TRANSPORT(self), int_to_zig_zag(NUM2INT(i32)));
+  write_varint32(GET_TRANSPORT(self), int_to_zig_zag(checked_i32_value(i32)));
   return Qnil;
 }
 
 VALUE rb_thrift_compact_proto_write_i64(VALUE self, VALUE i64) {
-  CHECK_NIL(i64);
-  write_varint64(GET_TRANSPORT(self), ll_to_zig_zag(NUM2LL(i64)));
+  write_varint64(GET_TRANSPORT(self), ll_to_zig_zag(checked_i64_value(i64)));
   return Qnil;
 }
 
@@ -330,8 +365,12 @@ VALUE rb_thrift_compact_proto_write_string(VALUE self, VALUE str) {
 VALUE rb_thrift_compact_proto_write_binary(VALUE self, VALUE buf) {
   buf = force_binary_encoding(buf);
   VALUE transport = GET_TRANSPORT(self);
-  write_varint32(transport, (uint32_t)RSTRING_LEN(buf));
-  WRITE(transport, StringValuePtr(buf), RSTRING_LEN(buf));
+  long size = RSTRING_LEN(buf);
+  if (RB_UNLIKELY(size > INT32_MAX)) {
+    rb_raise(rb_eRangeError, "integer out of bounds");
+  }
+  write_varint32(transport, (uint32_t)size);
+  WRITE(transport, StringValuePtr(buf), size);
   return Qnil;
 }
 
@@ -416,10 +455,20 @@ static int8_t get_ttype(int8_t ctype) {
   } else if (ctype == CTYPE_UUID) {
     return TTYPE_UUID;
   } else {
-    char str[50];
-    sprintf(str, "don't know what type: %d", ctype);
-    rb_raise(rb_eStandardError, "%s", str);
-    return 0;
+    rb_exc_raise(get_protocol_exception(
+      INT2FIX(PROTOERR_INVALID_DATA),
+      rb_sprintf("Unknown compact type: %d", ctype)
+    ));
+    return 0; /* unreachable */
+  }
+}
+
+static inline void validate_container_size(uint32_t size) {
+  if (RB_UNLIKELY(size > INT32_MAX)) {
+    rb_exc_raise(get_protocol_exception(
+      INT2FIX(PROTOERR_SIZE_LIMIT),
+      rb_str_new2("Container size limit exceeded")
+    ));
   }
 }
 
@@ -437,6 +486,7 @@ static int32_t zig_zag_to_int(uint32_t n) {
 }
 
 #define MAX_VARINT32_BYTES 5  /* ceil(32/7); matches protobuf wire format */
+#define MAX_VARINT32_LAST_BYTE 0x0f
 #define MAX_VARINT64_BYTES 10 /* ceil(64/7); matches protobuf wire format */
 
 static uint64_t read_varint64(VALUE self) {
@@ -457,7 +507,7 @@ static uint64_t read_varint64(VALUE self) {
 static uint32_t read_varint32(VALUE self) {
   int i, shift = 0;
   uint32_t result = 0;
-  for (i = 0; i < MAX_VARINT32_BYTES; i++) {
+  for (i = 0; i < MAX_VARINT32_BYTES - 1; i++) {
     int8_t b = read_byte_direct(self);
     result |= ((uint32_t)(b & 0x7f) << shift);
     if ((b & 0x80) != 0x80) {
@@ -465,8 +515,15 @@ static uint32_t read_varint32(VALUE self) {
     }
     shift += 7;
   }
-  rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_INVALID_DATA), rb_str_new2("Variable-length int over 5 bytes.")));
-  return 0; /* unreachable */
+
+  int8_t b = read_byte_direct(self);
+  if (RB_UNLIKELY((b & 0x80) != 0)) {
+    rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_INVALID_DATA), rb_str_new2("Variable-length int over 5 bytes.")));
+  }
+  if (RB_UNLIKELY((b & ~MAX_VARINT32_LAST_BYTE) != 0)) {
+    rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_INVALID_DATA), rb_str_new2("Variable-length int overflows uint32.")));
+  }
+  return result | ((uint32_t)b << shift);
 }
 
 static int16_t read_i16(VALUE self) {
@@ -504,21 +561,23 @@ VALUE rb_thrift_compact_proto_read_set_end(VALUE self) {
 }
 
 VALUE rb_thrift_compact_proto_read_message_begin(VALUE self) {
+  if (RTEST(rb_ivar_get(self, reset_message_size_ivar_id))) {
+    rb_funcall(GET_TRANSPORT(self), reset_message_size_method_id, 0);
+  }
+
   int8_t protocol_id = read_byte_direct(self);
   if (protocol_id != PROTOCOL_ID) {
     char buf[100];
-    int len = sprintf(buf, "Expected protocol id %d but got %d", PROTOCOL_ID, protocol_id);
-    buf[len] = 0;
-    rb_exc_raise(get_protocol_exception(INT2FIX(-1), rb_str_new2(buf)));
+    snprintf(buf, sizeof(buf), "Expected protocol id %d but got %d", PROTOCOL_ID, protocol_id);
+    rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_BAD_VERSION), rb_str_new2(buf)));
   }
 
   int8_t version_and_type = read_byte_direct(self);
   int8_t version = version_and_type & VERSION_MASK;
   if (version != VERSION) {
     char buf[100];
-    int len = sprintf(buf, "Expected version id %d but got %d", version, VERSION);
-    buf[len] = 0;
-    rb_exc_raise(get_protocol_exception(INT2FIX(-1), rb_str_new2(buf)));
+    snprintf(buf, sizeof(buf), "Expected version %d but got %d", VERSION, version);
+    rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_BAD_VERSION), rb_str_new2(buf)));
   }
 
   int8_t type = (version_and_type >> TYPE_SHIFT_AMOUNT) & TYPE_BITS;
@@ -561,6 +620,7 @@ VALUE rb_thrift_compact_proto_read_field_begin(VALUE self) {
 
 VALUE rb_thrift_compact_proto_read_map_begin(VALUE self) {
   uint32_t size = read_varint32(self);
+  validate_container_size(size);
   uint8_t key_and_value_type = size == 0 ? 0 : read_byte_direct(self);
   return rb_ary_new3(3, INT2FIX(get_ttype(key_and_value_type >> 4)), INT2FIX(get_ttype(key_and_value_type & 0xf)), UINT2NUM(size));
 }
@@ -571,6 +631,7 @@ VALUE rb_thrift_compact_proto_read_list_begin(VALUE self) {
   if (size == 15) {
     size = read_varint32(self);
   }
+  validate_container_size(size);
   uint8_t type = get_ttype(size_and_type & 0x0f);
   return rb_ary_new3(2, INT2FIX(type), UINT2NUM(size));
 }
@@ -608,19 +669,19 @@ VALUE rb_thrift_compact_proto_read_i64(VALUE self) {
 VALUE rb_thrift_compact_proto_read_double(VALUE self) {
   union {
     double f;
-    int64_t l;
+    uint64_t l;
   } transfer;
   VALUE rbuf = rb_ivar_get(self, rbuf_ivar_id);
   rb_funcall(GET_TRANSPORT(self), read_into_buffer_method_id, 2, rbuf, INT2FIX(8));
-  uint32_t lo = ((uint8_t)(RSTRING_PTR(rbuf)[0]))
-    | (((uint8_t)(RSTRING_PTR(rbuf)[1])) << 8)
-    | (((uint8_t)(RSTRING_PTR(rbuf)[2])) << 16)
-    | (((uint8_t)(RSTRING_PTR(rbuf)[3])) << 24);
-  uint64_t hi = (((uint8_t)(RSTRING_PTR(rbuf)[4])))
-    | (((uint8_t)(RSTRING_PTR(rbuf)[5])) << 8)
-    | (((uint8_t)(RSTRING_PTR(rbuf)[6])) << 16)
-    | (((uint8_t)(RSTRING_PTR(rbuf)[7])) << 24);
-  transfer.l = (hi << 32) | lo;
+  const uint8_t* bytes = (const uint8_t*)RSTRING_PTR(rbuf);
+  transfer.l = (uint64_t)bytes[0]
+    | ((uint64_t)bytes[1] << 8)
+    | ((uint64_t)bytes[2] << 16)
+    | ((uint64_t)bytes[3] << 24)
+    | ((uint64_t)bytes[4] << 32)
+    | ((uint64_t)bytes[5] << 40)
+    | ((uint64_t)bytes[6] << 48)
+    | ((uint64_t)bytes[7] << 56);
 
   return rb_float_new(transfer.f);
 }
@@ -632,6 +693,10 @@ VALUE rb_thrift_compact_proto_read_string(VALUE self) {
 
 VALUE rb_thrift_compact_proto_read_binary(VALUE self) {
   uint32_t size = read_varint32(self);
+  if (RB_UNLIKELY(size > INT32_MAX)) {
+    rb_exc_raise(get_protocol_exception(INT2FIX(PROTOERR_SIZE_LIMIT), rb_str_new2("Binary size limit exceeded")));
+  }
+  CHECK_STRING_SIZE(self, size);
   return rb_funcall(GET_TRANSPORT(self), read_all_method_id, 1, UINT2NUM(size));
 }