Uploaded image for project: 'Thrift'
  1. Thrift
  2. THRIFT-1414

bufferoverflow in c_glib buffered transport/socket client

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 0.7
    • Fix Version/s: None
    • Component/s: C glib - Library
    • Labels:
      None
    • Environment:

      Server running on Windows 7 SP1 64bit based on csharp.
      Client running on Ubuntu 11.04 Server 64 bit (fresh install) based on c_glib.
      svn rev: 1190015M

    • Patch Info:
      Patch Available

      Description

      Quote of comment in source:
      -----------------------------------------------
      if the buffer is still smaller than what we
      want to read, then just read it directly.
      -----------------------------------------------

      But the code reading into the tempdata with size of the buffer and reading all data into this.
      file: lib/c_glib/transport/thrift_buffered_transport.c line 74/98

      Also if the buffer is still bigger that what we want to read, then reading the buffer size.
      But recv blocks than and waiting of data if there nothing to read after the receiving data len.
      file: lib/c_glib/transport/thrift_buffered_transport.c line 118

      i attached a patch that fix this problems but i dont know if all of this is correct.

        Attachments

        1. THRIFT-1414.patch
          2 kB
          Christian Zimnick
        2. thrift-0.9.0-c_glib-jira1414.patch
          1 kB
          Maik Greubel

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                -nighty- Christian Zimnick
              • Votes:
                3 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 10m
                  10m
                  Remaining:
                  Remaining Estimate - 10m
                  10m
                  Logged:
                  Time Spent - Not Specified
                  Not Specified