Skip to content

Conversation

@ashish-kumar-sharma
Copy link
Contributor

What changes were proposed in this pull request?

Thrift version bump from 0.13.0 to 0.14.1

Why are the changes needed?

To fix existing security issued in 0.13.0 https://nvd.nist.gov/vuln/detail/CVE-2020-13949

Does this PR introduce any user-facing change?

No

How was this patch tested?

Since this is version upgrade only. If all the existing test case cleared then we are good to go.

Copy link
Contributor

@mattmccline-microsoft mattmccline-microsoft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the new 0.14.1 methods such as getMinSerializedSize, do we understand:

  1. why the method was added?
  2. Is it possible the Thrift library call it on our objects now? What is the expected behavior? Is there a way to indicate not implemented like returning -1

Copy link
Contributor

@mattmccline-microsoft mattmccline-microsoft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about the seperate standalone-metastore Hive project? It specifies the libthrift.version

Copy link
Contributor

@mattmccline-microsoft mattmccline-microsoft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about the separate standalone-metastore Hive project? It specifies the libthrift.version, too.

@ashish-kumar-sharma
Copy link
Contributor Author

What about the seperate standalone-metastore Hive project? It specifies the libthrift.version

Yes seperate standalone-metastore also specifies the libthrift.version. I have bumped the version for that also.

@ashish-kumar-sharma
Copy link
Contributor Author

For the new 0.14.1 methods such as getMinSerializedSize, do we understand:

  1. why the method was added?
  2. Is it possible the Thrift library call it on our objects now? What is the expected behavior? Is there a way to indicate not implemented like returning -1

This methods got added as part of interface changes in thrift 0.14.1. We don't understand and use this methods as of now. So i will return -1;

Copy link
Contributor

@mattmccline-microsoft mattmccline-microsoft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@sankarh sankarh changed the title HIVE-25908: Upgrade thrift from 0.13.0 to 0.14.1 HIVE-25098: Upgrade thrift from 0.13.0 to 0.14.1 Jun 9, 2021
@sankarh sankarh merged commit 2fc946f into apache:master Jun 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants