Thrift
  1. Thrift
  2. THRIFT-1414

bufferoverflow in c_glib buffered transport/socket client

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: 0.7
    • Fix Version/s: None
    • Component/s: C glib - Library
    • Labels:
      None
    • Environment:

      Server running on Windows 7 SP1 64bit based on csharp.
      Client running on Ubuntu 11.04 Server 64 bit (fresh install) based on c_glib.
      svn rev: 1190015M

    • Patch Info:
      Patch Available

      Description

      Quote of comment in source:
      -----------------------------------------------
      if the buffer is still smaller than what we
      want to read, then just read it directly.
      -----------------------------------------------

      But the code reading into the tempdata with size of the buffer and reading all data into this.
      file: lib/c_glib/transport/thrift_buffered_transport.c line 74/98

      Also if the buffer is still bigger that what we want to read, then reading the buffer size.
      But recv blocks than and waiting of data if there nothing to read after the receiving data len.
      file: lib/c_glib/transport/thrift_buffered_transport.c line 118

      i attached a patch that fix this problems but i dont know if all of this is correct.

      1. THRIFT-1414.patch
        2 kB
        Christian Zimnick
      2. thrift-0.9.0-c_glib-jira1414.patch
        1 kB
        Maik Greubel

        Issue Links

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              Christian Zimnick
            • Votes:
              3 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - 10m
                10m
                Remaining:
                Remaining Estimate - 10m
                10m
                Logged:
                Time Spent - Not Specified
                Not Specified

                  Development