CVE-2019-0210

@@ -32,10 +32,7 @@ const (
 // for references to _ParseContext see tsimplejson_protocol.go
 
 // JSON protocol implementation for thrift.
-//
-// This protocol produces/consumes a simple output format
-// suitable for parsing by scripting languages.  It should not be
-// confused with the full-featured TJSONProtocol.
+// Utilizes Simple JSON protocol
 //
 type TJSONProtocol struct {
 	*TSimpleJSONProtocol

@@ -60,7 +60,7 @@ func (p _ParseContext) String() string {
 	return "UNKNOWN-PARSE-CONTEXT"
 }
 
-// JSON protocol implementation for thrift.
+// Simple JSON protocol implementation for thrift.
 //
 // This protocol produces/consumes a simple output format
 // suitable for parsing by scripting languages.  It should not be
@@ -1316,7 +1316,7 @@ func (p *TSimpleJSONProtocol) readNumeric() (Numeric, error) {
 func (p *TSimpleJSONProtocol) safePeekContains(b []byte) bool {
 	for i := 0; i < len(b); i++ {
 		a, _ := p.reader.Peek(i + 1)
-		if len(a) == 0 || a[i] != b[i] {
+		if len(a) < (i+1) || a[i] != b[i] {
 			return false
 		}
 	}

@@ -714,3 +714,25 @@ func TestWriteSimpleJSONProtocolMap(t *testing.T) {
 	}
 	trans.Close()
 }
+
+func TestWriteSimpleJSONProtocolSafePeek(t *testing.T) {
+	trans := NewTMemoryBuffer()
+	p := NewTSimpleJSONProtocol(trans)
+	trans.Write([]byte{'a', 'b'})
+	trans.Flush(context.Background())
+	
+	test1 := p.safePeekContains([]byte{'a', 'b'})
+	if !test1 {
+		t.Fatalf("Should match at test 1")
+	}
+	
+	test2 := p.safePeekContains([]byte{'a', 'b', 'c', 'd'})
+	if test2 {
+		t.Fatalf("Should not match at test 2")
+	}
+	
+	test3 := p.safePeekContains([]byte{'x', 'y'})
+	if test3 {
+		t.Fatalf("Should not match at test 3")
+	}
+}