[THRIFT-1414] bufferoverflow in c_glib buffered transport/socket client

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.7
• Component/s: C glib - Library

Environment

Server running on Windows 7 SP1 64bit based on csharp.
Client running on Ubuntu 11.04 Server 64 bit (fresh install) based on c_glib.
svn rev: 1190015M

• Patch Info: Patch Available
• Assignee: Unassigned
• Reporter: Christian Zimnick
• Created: 30/Oct/11 17:33
• Updated: 24/Oct/12 18:52
• Resolved: 17/Oct/12 22:06

Description

Quote of comment in source:
-----------------------------------------------
if the buffer is still smaller than what we
want to read, then just read it directly.
-----------------------------------------------

But the code reading into the tempdata with size of the buffer and reading all data into this.
file: lib/c_glib/transport/thrift_buffered_transport.c line 74/98

Also if the buffer is still bigger that what we want to read, then reading the buffer size.
But recv blocks than and waiting of data if there nothing to read after the receiving data len.
file: lib/c_glib/transport/thrift_buffered_transport.c line 118

i attached a patch that fix this problems but i dont know if all of this is correct.

Issue Links

• is duplicated by: THRIFT-1654 c_glib thrift_socket_read() returns corrupted data