THRIFT-1932 TFileTransport::readEvent() casts values read from input stream into a pointer and then dereferences it.
Patch: Hugo Mildenberger
diff --git a/lib/cpp/src/thrift/transport/TFileTransport.cpp b/lib/cpp/src/thrift/transport/TFileTransport.cpp
index 0cbf357..4b6ea47 100644
--- a/lib/cpp/src/thrift/transport/TFileTransport.cpp
+++ b/lib/cpp/src/thrift/transport/TFileTransport.cpp
@@ -711,9 +711,10 @@
readState_.eventSizeBuff_[readState_.eventSizeBuffPos_++] =
readBuff_[readState_.bufferPtr_++];
+
if (readState_.eventSizeBuffPos_ == 4) {
- // 0 length event indicates padding
- if (*((uint32_t *)(readState_.eventSizeBuff_)) == 0) {
+ if (readState_.getEventSize() == 0) {
+ // 0 length event indicates padding
// T_DEBUG_L(1, "Got padding");
readState_.resetState(readState_.lastDispatchPtr_);
continue;
@@ -724,7 +725,7 @@
delete(readState_.event_);
}
readState_.event_ = new eventInfo();
- readState_.event_->eventSize_ = *((uint32_t *)(readState_.eventSizeBuff_));
+ readState_.event_->eventSize_ = readState_.getEventSize();
// check if the event is corrupted and perform recovery if required
if (isEventCorrupted()) {
diff --git a/lib/cpp/src/thrift/transport/TFileTransport.h b/lib/cpp/src/thrift/transport/TFileTransport.h
index edfc407..267305d 100644
--- a/lib/cpp/src/thrift/transport/TFileTransport.h
+++ b/lib/cpp/src/thrift/transport/TFileTransport.h
@@ -94,6 +94,11 @@
event_ = 0;
}
+ inline uint32_t getEventSize() {
+ const void *buffer=reinterpret_cast<const void *>(eventSizeBuff_);
+ return *reinterpret_cast<const uint32_t *>(buffer);
+ }
+
readState() {
event_ = 0;
resetAllValues();