Boost Serialization - No Exception Archive when deserializing corrupted data?

A few months ago, I implemented a component that receives data through a UDP network, deserializes it through Boost :: Serialization, and starts working with incoming objects.

After some time using this component, random crashes occurred, which I was able to solve after learning that someone else was sending data to my UDP port.

I solved this problem by simply adding try / catch around deserialization:

try { boost::archive::text_iarchive inputArchive(incomingData); inputArchive >> givenElements; //the actual deserialization, here the exception has been thrown in the past } catch( boost::archive::archive_exception& ex ) { std::cout << "Archive Exception during deserializing:" << std::endl; std::cout << ex.what() << std::endl; std::cout << "Incoming data had the following content:" << std::endl; std::cout << dataStream.str() << std::endl; } 

The above code has sorted out any external / corrupted data coming through the network and just deserializes the data that should have been.

At that time, I was working with the old version of the Boost version (I donโ€™t know very well 1.44, 1.42?) On a Linux machine.

Currently, I have to reuse the component on a computer running Windows XP with the fairly new Boost 1.46.1. Now the problem is that try / catch no longer filters external / corrupted data. As some of this code comes in, my application crashes without an error message.

It is not possible to change the port that I am listening to. In addition, I want to create a reliable application that ignores data that it could not work with, instead of crashes.

Now I am wondering if anyone has an idea why this effect is happening? Has Boost Become Less Reliable? Is this something with the OS? I have no idea and I hope that this is a question that can be answered by someone who is "more in Boost".

+4
source share
1 answer

My answer is not directly related to the extension of serialization, but it is always useful to do some verification of incoming data from the network before entering deeper logic.

Before diving into a deep sequential series, I suggest you:

  • Check UDP packet size
  • If you are using some kind of header, do some checking
  • Everything that seems right to you

and then try to deserialize the package. This way you can filter out external packages yourself , rather than relying on boost.

+1
source

All Articles