[THRIFT-510] segmentation fault in errorTimeWrapper

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 0.2
• Component/s: C++ - Library

Environment

ubuntu / intel

• Patch Info: Patch Available
• Assignee: Unassigned
• Reporter: Mathieu Poumeyrol
• Created: 20/May/09 10:56
• Updated: 01/Nov/11 02:52
• Resolved: 21/May/09 02:30

Description

During scribe startup, thrift triggers a potential segmentation fault right after the first message that uses errorTimeWrapper:

 
[Wed May 20 09:58:52 2009] "Starting scribe server on port 1463" 
Thrift: Wed May 20 09:58:52 2009 TServerSocket::listen() IPV6_V6ONLY
*** stack smashing detected ***: /usr/local/bin/scribed terminated
======= Backtrace: =========
/lib/tls/i686/nosegneg/libc.so.6(__fortify_fail+0x48)[0x6b0cf8]
/lib/tls/i686/nosegneg/libc.so.6(__fortify_fail+0x0)[0x6b0cb0]
/usr/local/lib/libthrift.so.0[0xee14c4]
/usr/local/lib/libthrift.so.0(_ZN6apache6thrift7TOutput16errorTimeWrapperEPKc+0x7d)[0xe93194]
/usr/local/lib/libthrift.so.0(_ZN6apache6thrift7TOutputclEPKc+0x13)[0xec3cef]

The problem is detected by the Stack Smashing Protection, which has been somehow enabled on my compiler.

In lib/cpp/src/Thrift.h, errorTimeWrapper uses a 25 character long buffer as a placeholder for a call to ctime_r. According to the man page, ctime_r requires a 26 characters buffer.

Changing the buffer size made everything work again.