Ted Wang created THRIFT-3941: -------------------------------- Summary: WinXP version of thrift_poll() relies on undefined behavior by passing a destructed variable to select() Key: THRIFT-3941 URL: https://issues.apache.org/jira/browse/THRIFT-3941 Project: Thrift Issue Type: Bug Components: C++ - Library Affects Versions: 0.9.3 Reporter: Ted Wang Assignee: Ted Wang
thrift_poll() for WINVER <= 0x0502 in thrift/windows/WinFnctl.cpp shadows the 'time_out' variable, and it ends up passing the destructed copy to select(): timeval time_out; timeval* time_out_ptr = NULL; if (timeout >= 0) { timeval time_out = {timeout / 1000, (timeout % 1000) * 1000}; time_out_ptr = &time_out; } else { // to avoid compiler warnings (void)time_out; (void)timeout; } int sktready = select(1, read_fds_ptr, write_fds_ptr, NULL, time_out_ptr); Stepping through this code in the debugger, it looks like MSVC reserves a large enough stack frame to avoid overwriting the variable when calling select(), which may be why this hasn't been caught yet. -- This message was sent by Atlassian JIRA (v6.3.4#6332)