You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The IncompleteMessageTest tests the behaviour of Queue when a write is started but not completed. A second write is then attempted, which - correctly - forces the lock and succeeds.
The issue is that data written by the incomplete attempt remains in the queue. If the second write is shorter then this (junk) data will remain after the end of the valid write. This junk data can then be misread as a valid header, which leads to undefined behaviour.
eg, after the writes in the above test, the queue looks like:
The last valid entry is "world". The "...longer write" is junk data which is not considered part of the queue and will be overwritten by further writes.
However, AbstractWire.readDataHeader sees the "00 00 20 6c" bytes, which should be "00 00 00 00" - end of queue - but the 20 6c dangling from the failed write are picked up as part of the header value.
Fix is to ensure the next 4 bytes (after padding) are cleared to 0 when a write context is closed.
The text was updated successfully, but these errors were encountered:
The IncompleteMessageTest tests the behaviour of Queue when a write is started but not completed. A second write is then attempted, which - correctly - forces the lock and succeeds.
The issue is that data written by the incomplete attempt remains in the queue. If the second write is shorter then this (junk) data will remain after the end of the valid write. This junk data can then be misread as a valid header, which leads to undefined behaviour.
eg, after the writes in the above test, the queue looks like:
The last valid entry is "world". The "...longer write" is junk data which is not considered part of the queue and will be overwritten by further writes.
However, AbstractWire.readDataHeader sees the "00 00 20 6c" bytes, which should be "00 00 00 00" - end of queue - but the 20 6c dangling from the failed write are picked up as part of the header value.
Fix is to ensure the next 4 bytes (after padding) are cleared to 0 when a write context is closed.
The text was updated successfully, but these errors were encountered: