[
https://issues.apache.org/jira/browse/THRIFT-3941?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-3941.
--------------------------------
Resolution: Fixed
Fix Version/s: 0.10.0
Committed, thank you both.
> WinXP version of thrift_poll() relies on undefined behavior by passing a
> destructed variable to select()
> --------------------------------------------------------------------------------------------------------
>
> Key: THRIFT-3941
> URL: https://issues.apache.org/jira/browse/THRIFT-3941
> Project: Thrift
> Issue Type: Bug
> Components: C++ - Library
> Affects Versions: 0.9.3
> Reporter: Ted Wang
> Assignee: Ted Wang
> Fix For: 0.10.0
>
>
> thrift_poll() for WINVER <= 0x0502 in thrift/windows/WinFnctl.cpp shadows the
> 'time_out' variable, and it ends up passing the destructed copy to select():
> timeval time_out;
> timeval* time_out_ptr = NULL;
> if (timeout >= 0) {
> timeval time_out = {timeout / 1000, (timeout % 1000) * 1000};
> time_out_ptr = &time_out;
> } else { // to avoid compiler warnings
> (void)time_out;
> (void)timeout;
> }
> int sktready = select(1, read_fds_ptr, write_fds_ptr, NULL, time_out_ptr);
> Stepping through this code in the debugger, it looks like MSVC reserves a
> large enough stack frame to avoid overwriting the variable when calling
> select(), which may be why this hasn't been caught yet.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
