[THRIFT-1654] c_glib thrift_socket_read() returns corrupted data

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 0.7, 0.8
• Fix Version/s: 0.9
• Component/s: C glib - Library

Environment

Linux

• Assignee: Unassigned
• Reporter: Andris Mednis
• Created: 24/Jul/12 15:29
• Updated: 25/Jul/12 14:42
• Resolved: 25/Jul/12 14:42

Description

In Thrift source code there is a file lib/c_glib/src/transport/thrift_socket.c. In this file there is a function thrift_socket_read():
------------------------------------------------------
...
/* implements thrift_transport_read */
gint32
thrift_socket_read (ThriftTransport *transport, gpointer buf,
guint32 len, GError **error)
{
gint ret = 0;
guint got = 0;

ThriftSocket *socket = THRIFT_SOCKET (transport);

while (got < len)
{
ret = recv (socket->sd, buf, len, 0); <====== In each while-loop iteration data are written from the beginning of buffer. Previously collected data are overwritten. This eventually leads to a corrupted frame in Thrift framed ransport and causes crash. To fix, replace 'buf' with 'buf + got', 'len' with 'len-got'.

if (ret < 0)

{ g_set_error (error, THRIFT_TRANSPORT_ERROR, THRIFT_TRANSPORT_ERROR_RECEIVE, "failed to read %d bytes - %s", len, strerror(errno)); return -1; }

got += ret;
}

return got;
}
...
------------------------------------------------------

At time of writing this bug is in Thrift 0.7, 0.8 and in trunk.

Issue Links

• duplicates: THRIFT-1414 bufferoverflow in c_glib buffered transport/socket client