From e49722c6984ca8f099b6f5b6c6e8f4372bc30179 Mon Sep 17 00:00:00 2001 From: Steve Loughran Date: Tue, 26 May 2026 17:30:01 +0100 Subject: [PATCH 1/3] GH-3572 Bump thrift to 0.23 Added instructions in docs as to where to find the gpg/sha signatures and a link to the thrift team KEYS file. --- README.md | 14 +++++++++----- dev/ci-before_install.sh | 2 +- pom.xml | 2 +- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 221970ee93..1ce03d5fd0 100644 --- a/README.md +++ b/README.md @@ -43,19 +43,23 @@ Parquet-Java uses Maven to build and depends on the thrift compiler (protoc is n To build and install the thrift compiler, run: ``` -wget -nv https://archive.apache.org/dist/thrift/0.22.0/thrift-0.22.0.tar.gz -tar xzf thrift-0.22.0.tar.gz -cd thrift-0.22.0 +wget -nv https://archive.apache.org/dist/thrift/0.23.0/thrift-0.23.0.tar.gz +tar xzf thrift-0.23.0.tar.gz +cd thrift-0.23.0 chmod +x ./configure ./configure --disable-libs sudo make install -j ``` -If you're on OSX and use homebrew, you can instead install Thrift 0.22.0 with `brew` and ensure that it comes first in your `PATH`. +Note: if you wish to verify the signature and checksum of a release: +1. The GPG and sha checksums can be found under https://archive.apache.org/dist/thrift/0.23.0/ +2. Validate the signature of the artifact against the [Thrift committer KEYS](https://downloads.apache.org/thrift/KEYS). + +If you're on OSX and use homebrew, you can instead install Thrift 0.23.0 with `brew` and ensure that it comes first in your `PATH`. ``` brew install thrift -export PATH="/usr/local/opt/thrift@0.22.0/bin:$PATH" +export PATH="/usr/local/opt/thrift@0.23.0/bin:$PATH" ``` ### Build Parquet with Maven diff --git a/dev/ci-before_install.sh b/dev/ci-before_install.sh index 2cfaee56a3..e5dad054db 100755 --- a/dev/ci-before_install.sh +++ b/dev/ci-before_install.sh @@ -20,7 +20,7 @@ # This script gets invoked by the CI system in a "before install" step ################################################################################ -export THRIFT_VERSION=0.22.0 +export THRIFT_VERSION=0.23.0 set -e set -o pipefail diff --git a/pom.xml b/pom.xml index 8b5a2ea578..95fafa736e 100644 --- a/pom.xml +++ b/pom.xml @@ -89,7 +89,7 @@ thrift ${thrift.executable} 0.10.0 - 0.22.0 + 0.23.0 ${thrift.version} 8.5.18 0.9.33 From 66dae3f8d6a3116e373344684c4a559d597a55e0 Mon Sep 17 00:00:00 2001 From: Steve Loughran Date: Wed, 27 May 2026 15:14:45 +0100 Subject: [PATCH 2/3] Thrift 0.23 now checks limits (good!) on read write and depth But it means: if you don't supply a TTransport to TProtocol ctor you hit an NPE during IO whenever those limits are validated. Add a StubTTransport which no-ops the read range check and declares there's no limit on depth checking. --- .../thrift/BufferedProtocolReadToWrite.java | 2 +- .../parquet/thrift/ParquetProtocol.java | 4 +- .../apache/parquet/thrift/StubTTransport.java | 80 +++++++++++++++++++ 3 files changed, 83 insertions(+), 3 deletions(-) create mode 100644 parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java diff --git a/parquet-thrift/src/main/java/org/apache/parquet/thrift/BufferedProtocolReadToWrite.java b/parquet-thrift/src/main/java/org/apache/parquet/thrift/BufferedProtocolReadToWrite.java index 7e8a1633f8..e1c2aae57a 100644 --- a/parquet-thrift/src/main/java/org/apache/parquet/thrift/BufferedProtocolReadToWrite.java +++ b/parquet-thrift/src/main/java/org/apache/parquet/thrift/BufferedProtocolReadToWrite.java @@ -579,7 +579,7 @@ private void checkEnum(ThriftType expectedType, int i) { class NullProtocol extends TProtocol { public NullProtocol() { - super(null); + super(StubTTransport.INSTANCE); } @Override diff --git a/parquet-thrift/src/main/java/org/apache/parquet/thrift/ParquetProtocol.java b/parquet-thrift/src/main/java/org/apache/parquet/thrift/ParquetProtocol.java index ab35497181..4094bebc40 100644 --- a/parquet-thrift/src/main/java/org/apache/parquet/thrift/ParquetProtocol.java +++ b/parquet-thrift/src/main/java/org/apache/parquet/thrift/ParquetProtocol.java @@ -38,7 +38,7 @@ public abstract class ParquetProtocol extends TProtocol { private String name; ParquetProtocol() { - super(null); + super(StubTTransport.INSTANCE); } private String getClassInfo() { @@ -54,7 +54,7 @@ private String getClassInfo() { * @param name a meaningful debugging name for anonymous inner classes */ public ParquetProtocol(String name) { - super(null); + super(StubTTransport.INSTANCE); this.name = name; } diff --git a/parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java b/parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java new file mode 100644 index 0000000000..a149f571fc --- /dev/null +++ b/parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java @@ -0,0 +1,80 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.parquet.thrift; + +import org.apache.thrift.TConfiguration; +import org.apache.thrift.transport.TTransport; +import org.apache.thrift.transport.TTransportException; + +/** + * A stub transport which implements the minimum amount needed for range/depth + * validation within the thrift library to succeed. + */ +public final class StubTTransport extends TTransport { + + public static final StubTTransport INSTANCE = new StubTTransport(); + + /** + * There's no limits on recursion depth. + */ + private final TConfiguration conf = new TConfiguration( + TConfiguration.DEFAULT_MAX_FRAME_SIZE, + TConfiguration.DEFAULT_MAX_MESSAGE_SIZE, + Integer.MAX_VALUE); + + private StubTTransport() { + } + + @Override + public void checkReadBytesAvailable(long l) { + } + + @Override + public boolean isOpen() { + return true; + } + + @Override + public void open() throws TTransportException { + throw new TTransportException("unsupported"); + } + + @Override + public void close() { + } + + @Override + public int read(byte[] bytes, int i, int i1) throws TTransportException { + throw new TTransportException("unsupported"); + } + + @Override + public void write(byte[] bytes, int i, int i1) throws TTransportException { + throw new TTransportException("unsupported"); + } + + @Override + public TConfiguration getConfiguration() { + return conf; + } + + @Override + public void updateKnownMessageSize(long l) { + } +} From 84a756bbf9f037d895d4db93239021dd2f7935b5 Mon Sep 17 00:00:00 2001 From: Steve Loughran Date: Wed, 27 May 2026 17:33:13 +0100 Subject: [PATCH 3/3] Spotless --- .../apache/parquet/thrift/StubTTransport.java | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java b/parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java index a149f571fc..d43ab9e8c2 100644 --- a/parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java +++ b/parquet-thrift/src/main/java/org/apache/parquet/thrift/StubTTransport.java @@ -34,16 +34,12 @@ public final class StubTTransport extends TTransport { * There's no limits on recursion depth. */ private final TConfiguration conf = new TConfiguration( - TConfiguration.DEFAULT_MAX_FRAME_SIZE, - TConfiguration.DEFAULT_MAX_MESSAGE_SIZE, - Integer.MAX_VALUE); + TConfiguration.DEFAULT_MAX_FRAME_SIZE, TConfiguration.DEFAULT_MAX_MESSAGE_SIZE, Integer.MAX_VALUE); - private StubTTransport() { - } + private StubTTransport() {} @Override - public void checkReadBytesAvailable(long l) { - } + public void checkReadBytesAvailable(long l) {} @Override public boolean isOpen() { @@ -56,8 +52,7 @@ public void open() throws TTransportException { } @Override - public void close() { - } + public void close() {} @Override public int read(byte[] bytes, int i, int i1) throws TTransportException { @@ -75,6 +70,5 @@ public TConfiguration getConfiguration() { } @Override - public void updateKnownMessageSize(long l) { - } + public void updateKnownMessageSize(long l) {} }