thrift/CVE-2018-1320.patch
2020-11-05 17:33:26 +08:00

33 lines
1.4 KiB
Diff

From d973409661f820d80d72c0034d06a12348c8705e Mon Sep 17 00:00:00 2001
From: "James E. King III" <jking@apache.org>
Date: Mon, 5 Mar 2018 11:34:21 -0500
Subject: [PATCH] THRIFT-4506: fix use of assert for correctness in Java SASL
negotiation Client: java
---
lib/java/src/org/apache/thrift/transport/TSaslTransport.java | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/lib/java/src/org/apache/thrift/transport/TSaslTransport.java b/lib/java/src/org/apache/thrift/transport/TSaslTransport.java
index a94d9a7760..bbd3f9a34a 100644
--- a/lib/java/src/org/apache/thrift/transport/TSaslTransport.java
+++ b/lib/java/src/org/apache/thrift/transport/TSaslTransport.java
@@ -287,7 +287,7 @@ public void open() throws TTransportException {
if (message.status == NegotiationStatus.COMPLETE &&
getRole() == SaslRole.CLIENT) {
LOGGER.debug("{}: All done!", getRole());
- break;
+ continue;
}
sendSaslMessage(sasl.isComplete() ? NegotiationStatus.COMPLETE : NegotiationStatus.OK,
@@ -295,8 +295,6 @@ public void open() throws TTransportException {
}
LOGGER.debug("{}: Main negotiation loop complete", getRole());
- assert sasl.isComplete();
-
// If we're the client, and we're complete, but the server isn't
// complete yet, we need to wait for its response. This will occur
// with ANONYMOUS auth, for example, where we send an initial response