[THRIFT-1931] Sending a frame size of zero to a TNonblockingServer causes an assertion failure

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 0.9
• Fix Version/s: 0.10.0
• Component/s: C++ - Library
• Labels: TNonblockingServer

Environment

Ubuntu 10.04 and 12.04, both 64-bit

• Assignee: James E. King III
• Reporter: Martin Michelsen
• Created: 16/Apr/13 02:51
• Updated: 12/Aug/16 01:29
• Resolved: 22/Jun/16 02:37

Description

TNonblockingServer::TConnection::workSocket doesn't check if readWant_ is zero before returning. Sending a frame with a size of zero leads to an assertion failure:
src/thrift/server/TNonblockingServer.cpp:494: void apache::thrift::server::TNonblockingServer::TConnection::workSocket(): Assertion `readBufferPos_ < readWant_' failed.

(You can reproduce this behavior on a TNonblockingServer by doing echo -e '\0\0\0\0' | nc server port.)

It can probably be fixed by checking if readWant_ is zero before the transition() call in workSocket, and disconnecting the client if so (just like what happens if readWant_ is too large). Not sure if this is necessarily the right thing to do though.