Details
-
Bug
-
Status: Closed
-
Critical
-
Resolution: Fixed
-
None
-
None
-
ubuntu / intel
-
Patch Available
Description
During scribe startup, thrift triggers a potential segmentation fault right after the first message that uses errorTimeWrapper:
[Wed May 20 09:58:52 2009] "Starting scribe server on port 1463" Thrift: Wed May 20 09:58:52 2009 TServerSocket::listen() IPV6_V6ONLY *** stack smashing detected ***: /usr/local/bin/scribed terminated ======= Backtrace: ========= /lib/tls/i686/nosegneg/libc.so.6(__fortify_fail+0x48)[0x6b0cf8] /lib/tls/i686/nosegneg/libc.so.6(__fortify_fail+0x0)[0x6b0cb0] /usr/local/lib/libthrift.so.0[0xee14c4] /usr/local/lib/libthrift.so.0(_ZN6apache6thrift7TOutput16errorTimeWrapperEPKc+0x7d)[0xe93194] /usr/local/lib/libthrift.so.0(_ZN6apache6thrift7TOutputclEPKc+0x13)[0xec3cef]
The problem is detected by the Stack Smashing Protection, which has been somehow enabled on my compiler.
In lib/cpp/src/Thrift.h, errorTimeWrapper uses a 25 character long buffer as a placeholder for a call to ctime_r. According to the man page, ctime_r requires a 26 characters buffer.
Changing the buffer size made everything work again.