Updated Branches: refs/heads/master 1beeaaadd -> 7f1df9924
THRIFT-1932 TFileTransport::readEvent() casts values read from input stream into a pointer and then dereferences it. Patch: Hugo Mildenberger Project: http://git-wip-us.apache.org/repos/asf/thrift/repo Commit: http://git-wip-us.apache.org/repos/asf/thrift/commit/7f1df992 Tree: http://git-wip-us.apache.org/repos/asf/thrift/tree/7f1df992 Diff: http://git-wip-us.apache.org/repos/asf/thrift/diff/7f1df992 Branch: refs/heads/master Commit: 7f1df992479fdcad208889e53b8b982e2428d250 Parents: 1beeaaa Author: Roger Meier <[email protected]> Authored: Sun May 5 23:29:34 2013 +0200 Committer: Roger Meier <[email protected]> Committed: Sun May 5 23:29:34 2013 +0200 ---------------------------------------------------------------------- lib/cpp/src/thrift/transport/TFileTransport.cpp | 7 ++++--- lib/cpp/src/thrift/transport/TFileTransport.h | 5 +++++ 2 files changed, 9 insertions(+), 3 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/thrift/blob/7f1df992/lib/cpp/src/thrift/transport/TFileTransport.cpp ---------------------------------------------------------------------- diff --git a/lib/cpp/src/thrift/transport/TFileTransport.cpp b/lib/cpp/src/thrift/transport/TFileTransport.cpp index 0cbf357..4b6ea47 100644 --- a/lib/cpp/src/thrift/transport/TFileTransport.cpp +++ b/lib/cpp/src/thrift/transport/TFileTransport.cpp @@ -711,9 +711,10 @@ eventInfo* TFileTransport::readEvent() { readState_.eventSizeBuff_[readState_.eventSizeBuffPos_++] = readBuff_[readState_.bufferPtr_++]; + if (readState_.eventSizeBuffPos_ == 4) { - // 0 length event indicates padding - if (*((uint32_t *)(readState_.eventSizeBuff_)) == 0) { + if (readState_.getEventSize() == 0) { + // 0 length event indicates padding // T_DEBUG_L(1, "Got padding"); readState_.resetState(readState_.lastDispatchPtr_); continue; @@ -724,7 +725,7 @@ eventInfo* TFileTransport::readEvent() { delete(readState_.event_); } readState_.event_ = new eventInfo(); - readState_.event_->eventSize_ = *((uint32_t *)(readState_.eventSizeBuff_)); + readState_.event_->eventSize_ = readState_.getEventSize(); // check if the event is corrupted and perform recovery if required if (isEventCorrupted()) { http://git-wip-us.apache.org/repos/asf/thrift/blob/7f1df992/lib/cpp/src/thrift/transport/TFileTransport.h ---------------------------------------------------------------------- diff --git a/lib/cpp/src/thrift/transport/TFileTransport.h b/lib/cpp/src/thrift/transport/TFileTransport.h index edfc407..267305d 100644 --- a/lib/cpp/src/thrift/transport/TFileTransport.h +++ b/lib/cpp/src/thrift/transport/TFileTransport.h @@ -94,6 +94,11 @@ typedef struct readState { event_ = 0; } + inline uint32_t getEventSize() { + const void *buffer=reinterpret_cast<const void *>(eventSizeBuff_); + return *reinterpret_cast<const uint32_t *>(buffer); + } + readState() { event_ = 0; resetAllValues();
