[THRIFT-3062] C++ TServerSocket invalid port number (over 999999) causes stack corruption

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.9.2
• Fix Version/s: 0.9.3
• Component/s: C++ - Library
• Labels: security
• Assignee: James E. King III
• Reporter: James E. King III
• Created: 30/Mar/15 18:41
• Updated: 21/Jul/15 02:21
• Resolved: 04/May/15 13:36

Description

In TServerSocket::listen() a buffer of size 7 is allocated for the string to numeric translation of the port number, defined as int:

  char port[sizeof("65536") + 1];
  ...
  sprintf(port, "%d", port_);

An input of 1000000 or more will cause stack corruption. Recommend changing sprintf to something safer, or making a larger buffer. In this case, one can safely allocate a fixed size buffer on the stack to accomodate the largest result possible, avoiding the problem. Alternatively, ensure the input is bound, which is what TSocket::localOpen() does.

Issue Links

• is blocked by: THRIFT-1025 C++ ServerSocket should inherit from Socket with the necessary Ctor to listen on connections from a specific host (similar to perl library)