THRIFT-4485 Possible invalid ptr AV with overlapped read/write on pipes

Client: Delphi Patch: Jens Geyer This closes apache#1489
danielhtshih · Feb 2, 2018 · 0064516 · 0064516
1 parent 5089b0a
commit 0064516
Showing 1 changed file with 12 additions and 6 deletions.
diff --git a/lib/delphi/src/Thrift.Transport.Pipes.pas b/lib/delphi/src/Thrift.Transport.Pipes.pas
@@ -373,8 +373,10 @@ procedure TPipeStreamBase.WriteOverlapped( const pBuf : Pointer; offset: Integer
         ERROR_IO_PENDING : begin
           dwWait := overlapped.WaitFor(FTimeout);
 
-          if (dwWait = WAIT_TIMEOUT)
-          then raise TTransportExceptionTimedOut.Create('Pipe write timed out');
+          if (dwWait = WAIT_TIMEOUT) then begin
+            CancelIo( FPipe);  // prevents possible AV on invalid overlapped ptr
+            raise TTransportExceptionTimedOut.Create('Pipe write timed out');
+          end;
 
           if (dwWait <> WAIT_OBJECT_0)
           or not GetOverlappedResult( FPipe, overlapped.Overlapped, cbWritten, TRUE)
@@ -473,8 +475,10 @@ function TPipeStreamBase.ReadOverlapped( const pBuf : Pointer; const buflen : In
         ERROR_IO_PENDING : begin
           dwWait := overlapped.WaitFor(FTimeout);
 
-          if (dwWait = WAIT_TIMEOUT)
-          then raise TTransportExceptionTimedOut.Create('Pipe read timed out');
+          if (dwWait = WAIT_TIMEOUT) then begin
+            CancelIo( FPipe);  // prevents possible AV on invalid overlapped ptr
+            raise TTransportExceptionTimedOut.Create('Pipe read timed out');
+          end;
 
           if (dwWait <> WAIT_OBJECT_0)
           or not GetOverlappedResult( FPipe, overlapped.Overlapped, cbRead, TRUE)
@@ -876,8 +880,10 @@ function TNamedPipeServerTransportImpl.Accept(const fnAccepting: TProc): ITransp
   CreateNamedPipe;
   while not FConnected do begin
 
-    if QueryStopServer
-    then Abort;
+    if QueryStopServer then begin
+      InternalClose;
+      Abort;
+    end;
 
     if Assigned(fnAccepting)
     then fnAccepting();