[THRIFT-4107] Thrift Server crashes when receiving specific bad packet

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.9.1, 0.9.2, 0.9.3, 0.10.0
• Component/s: C++ - Library
• Labels: easyfix easytest security

Environment

Ubuntu 12.04
Thrift 0.9.1

• Assignee: Unassigned
• Reporter: Yurong LIAO
• Created: 03/Mar/17 02:28
• Updated: 30/Mar/20 02:32

Description

A server program with Thrift 0.9.1 always crash when receiving a specific packet from client. It's 100% reproducible by intentionally sending a packet consist of any 4 bytes followed with a 0.
After checking the code, it is found that the crash is caused by an assert in method TNonblockingServer::TConnection::workSocket() (line 494, file TNonblockingServer.cpp). To prevent the crash, protection code can be add to check readWant_ when receiving data from client.
The issue was found 0.9.1 and also exists in latter versions including latest code.