[
https://issues.apache.org/jira/browse/THRIFT-3062?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14395902#comment-14395902
]
ASF GitHub Bot commented on THRIFT-3062:
----------------------------------------
GitHub user jeking3 opened a pull request:
https://github.com/apache/thrift/pull/425
[THRIFT-3062] fix segfault on invalid port number
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/jeking3/thrift
bugfix/THRIFT-3062-invalid-port-number-segfault
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/thrift/pull/425.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #425
----
commit 9d5654389daab6ab6be6bdae110a1acede51e945
Author: Jim King <jim.k...@simplivity.com>
Date: 2015-04-04T19:47:34Z
[THRIFT-3062] fix segfault on invalid port number
----
> C++ TServerSocket invalid port number (over 999999) causes stack corruption
> ---------------------------------------------------------------------------
>
> Key: THRIFT-3062
> URL: https://issues.apache.org/jira/browse/THRIFT-3062
> Project: Thrift
> Issue Type: Bug
> Components: C++ - Library
> Affects Versions: 0.9.2
> Reporter: James E. King, III
> Labels: security
> Attachments: THRIFT-3062.patch
>
>
> In {{TServerSocket::listen()}} a buffer of size 7 is allocated for the string
> to numeric translation of the port number, defined as {{int}}:
> {noformat} char port[sizeof("65536") + 1];
> ...
> sprintf(port, "%d", port_);{noformat}
> An input of 1000000 or more will cause stack corruption. Recommend changing
> sprintf to something safer, or making a larger buffer. In this case, one can
> safely allocate a fixed size buffer on the stack to accomodate the largest
> result possible, avoiding the problem. Alternatively, ensure the input is
> bound, which is what {{TSocket::localOpen()}} does.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
