[jira] [Commented] (THRIFT-3941) WinXP version of thrift_poll() relies on undefined behavior by passing a destructed variable to select()

[ASF GitHub Bot (JIRA)]

    [ 
https://issues.apache.org/jira/browse/THRIFT-3941?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15545909#comment-15545909
 ] 

ASF GitHub Bot commented on THRIFT-3941:
----------------------------------------

GitHub user tpcwang opened a pull request:

    https://github.com/apache/thrift/pull/1107

    THRIFT-3941 WinXP version of thrift_poll() relies on undefined behavior by 
passing a destructed variable to select()

    

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/tpcwang/thrift THRIFT-3941

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/thrift/pull/1107.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #1107
    
----
commit d1c0d331992014f36b221ea707943cbaa3bfb3a3
Author: tpcwang <tpc.w...@gmail.com>
Date:   2016-10-04T16:34:37Z

    Fix WinXP version of thrift_poll to not use destructed time_out

----


> WinXP version of thrift_poll() relies on undefined behavior by passing a 
> destructed variable to select()
> --------------------------------------------------------------------------------------------------------
>
>                 Key: THRIFT-3941
>                 URL: https://issues.apache.org/jira/browse/THRIFT-3941
>             Project: Thrift
>          Issue Type: Bug
>          Components: C++ - Library
>    Affects Versions: 0.9.3
>            Reporter: Ted Wang
>            Assignee: Ted Wang
>
> thrift_poll() for WINVER <= 0x0502 in thrift/windows/WinFnctl.cpp shadows the 
> 'time_out' variable, and it ends up passing the destructed copy to select():
>   timeval time_out;
>   timeval* time_out_ptr = NULL;
>   if (timeout >= 0) {
>     timeval time_out = {timeout / 1000, (timeout % 1000) * 1000};
>     time_out_ptr = &time_out;
>   } else { // to avoid compiler warnings
>     (void)time_out;
>     (void)timeout;
>   }
>   int sktready = select(1, read_fds_ptr, write_fds_ptr, NULL, time_out_ptr);
> Stepping through this code in the debugger, it looks like MSVC reserves a 
> large enough stack frame to avoid overwriting the variable when calling 
> select(), which may be why this hasn't been caught yet.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)