[jira] [Created] (THRIFT-3941) WinXP version of thrift_poll() relies on undefined behavior by passing a destructed variable to select()

["Ted Wang (JIRA)" <ji...@apache.org>]

Ted Wang created THRIFT-3941:
--------------------------------

             Summary: WinXP version of thrift_poll() relies on undefined behavior by passing a destructed variable to select()
                 Key: THRIFT-3941
                 URL: https://issues.apache.org/jira/browse/THRIFT-3941
             Project: Thrift
          Issue Type: Bug
          Components: C++ - Library
    Affects Versions: 0.9.3
            Reporter: Ted Wang
            Assignee: Ted Wang


thrift_poll() for WINVER <= 0x0502 in thrift/windows/WinFnctl.cpp shadows the 'time_out' variable, and it ends up passing the destructed copy to select():

  timeval time_out;
  timeval* time_out_ptr = NULL;
  if (timeout >= 0) {
    timeval time_out = {timeout / 1000, (timeout % 1000) * 1000};
    time_out_ptr = &time_out;
  } else { // to avoid compiler warnings
    (void)time_out;
    (void)timeout;
  }

  int sktready = select(1, read_fds_ptr, write_fds_ptr, NULL, time_out_ptr);

Stepping through this code in the debugger, it looks like MSVC reserves a large enough stack frame to avoid overwriting the variable when calling select(), which may be why this hasn't been caught yet.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)