Date: Sun, 10 Aug 2003 18:02:40 -0400 (EDT) From: Robert Watson <rwatson@FreeBSD.org> To: FreeBSD-gnats-submit@FreeBSD.org Subject: bin/55448: dbm_nextkey() misbehaves after dbm_store() in dbm(3) Message-ID: <200308102202.h7AM2eLG090296@fledge.watson.org> Resent-Message-ID: <200308102210.h7AMAGmf038742@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 55448
>Category: bin
>Synopsis: dbm_nextkey() misbehaves after dbm_store() in dbm(3)
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Aug 10 15:10:16 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator: Robert Watson
>Release: FreeBSD 4.8-STABLE i386
>Organization:
>Environment:
System: FreeBSD fledge.watson.org 4.8-STABLE FreeBSD 4.8-STABLE #4: Mon Aug 4 00:26:28 EDT 2003 robert@fledge.watson.org:/home/data/obj/home/data/fbsd-stable/src/sys/FLEDGE i386
>Description:
dbm(3) provides a simply database API based on db(3). It appears to be
possible to create database corruption through the use of dbm_nextkey()
and dbm_store() in the event that an entry in the database undergoes
a size change. In particular, if you perform a dbm_fetch() on a key
returned by dbm_nextkey(), and then dbm_store() a larger value than
the data returned by dbm_fetch(), the next return from dbm_query() may
point into the newly updated value of the previous entry.
>How-To-Repeat:
We have a local DBM database with two types of entries: old entries that
have a data size of an int, and new entries, with a data size of two
ints. During a sweep of the database, the software may decide to update
fields from the old entry type to the new entry. Typically, this uses
the above-described sequence:
struct ipdata {
int int1;
int int2;
};
key = dbm_firstkey(dbm);
while (key.dptr != NULL) {
data = dbm_fetch(dbm, key);
switch (data.dsize) {
case sizeof(int):
/* fake up the new structure. */
break;
case sizeof(id):
id = *(struct ipdata *)data.dptr;
break;
default:
/* panic */
}
/* Perform data updates. */
data.dptr = (void *)&id;
data.dsize = sizeof(id);
if (dbm_store(dbm, key, data, DBM_REPLACE) == -1)
perror("dbm_store");
key = dbm_nextkey(dbm);
}
When an entry is upgraded, the next call to dbm_nextkey() returns the
second int in the new ipdata structure written, rather than the next
field, suggesting that the iterator isn't updated for write changes to
the database.
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200308102202.h7AM2eLG090296>