dxbjavid opened a new pull request, #3607: URL: https://github.com/apache/thrift/pull/3607
thrift_framed_transport_read_slow copies the bytes left over from the previous frame with memcpy(buf, t->r_buf, t->r_buf->len), which passes the GByteArray structure as the source instead of t->r_buf->data. When a read crosses a frame boundary with more than a few bytes still buffered (the peer controls the frame sizes), the structure's own pointer and length fields come back in place of the data and the copy runs past the end of the small GByteArray allocation, so adjacent heap memory leaks into the decoded message. The buffered transport carries the same mistake in its leftover path; both now read from t->r_buf->data like the other two copies in each file, and a cross-frame regression test driven through a memory buffer exercises the path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
