fix(thrift): bound skip() recursion depth to prevent stack overflow

[moshap-firebolt]

Background

The storage fuzzer (griffin_parquet_column) found a stack overflow parsing a crafted Parquet footer: packdb run 29895460517.

This vendored Thrift copy stubbed Apache Thrift's recursion-depth trackers as no-ops (see the comment above TInputRecursionTracker), so the generic apache::thrift::protocol::skip() helper recurses without limit. The generated Parquet deserializer routes every unknown field through iprot->skip(ftype) (229 sites), so a deeply nested unknown struct/list/set/map field drives unbounded recursion and overflows the stack. A stack overflow is a signal, not a C++ exception, so the reader's try/catch around ParquetFileReader::Open cannot contain it.

Summary

Restore the upstream recursion guard in skip(): thread a depth_limit (defaulting to TConfiguration::DEFAULT_RECURSION_DEPTH = 64) and throw TProtocolException::DEPTH_LIMIT when it is exhausted. The two-argument skip(prot, type) overload is preserved for existing callers.

Test Plan

• Standalone repro against this vendored Thrift (clang-22 + ASAN) feeding N nested-struct compact-protocol bytes through skip(T_STRUCT):
  • Before: AddressSanitizer: stack-overflow in the skip recursion (matches the CI stack trace).
  • After: throws TProtocolException type=6 (DEPTH_LIMIT); shallow/valid inputs parse unchanged.
• The originating CI crash artifact is being committed as a griffin-fuzzer regression seed in packdb.

🤖 Generated with Claude Code

[lorenzhs]

a) this change looks rather different than the removal, why? https://24d7106e4280c32d65165cd052b8309fd06478b7

b) what's with the random base branch? Why are we not using release-24.0? Please fix

The base branch was changed.

[lorenzhs]

merged the base branch PR

[moshap-firebolt]

Thanks @lorenzhs — both addressed:

(a) Good call. Rewrote it to restore the mechanism apache#86 removed rather than reimplement it: TInputRecursionTracker/TOutputRecursionTracker are real RAII guards again (templated on the protocol now, since apache#86 deleted the common TProtocol base), and TCompactProtocolT regains the input/output depth counters + limit (from the transport's TConfiguration, default 64). skip() reverts to its original form — just TInputRecursionTracker tracker(prot); at the top, no signature change. The 10 tracker instantiations already in the generated parquet_types.tcc are effective again too, so the generated read/write paths are guarded, not just skip().

(b) Already handled by your rebase onto release-24.0.0 — thanks. Force-pushed my new commit on the same parent, so the branch is a single commit on release-24.0.0.

Verified with a clang-22 + ASAN repro (incl. the generated-code-style CTAD call site): deep nested input throws DEPTH_LIMIT; before the fix it was an ASAN stack-overflow matching the CI trace; valid input unchanged.