Login
Log in using an SSO provider:
Fedora Account System
Red Hat Associate
Red Hat Customer
Login using a Red Hat Bugzilla account
Forgot Password
Create an Account
Red Hat Bugzilla – Attachment 1027042 Details for
Bug 1211871
heap corruption by memp_stat
Home
New
Search
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh90 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
[?]
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
Upstream patch for the 4.7.25 version
memp_stat_4.7.25.diff (text/plain), 5.25 KB, created by
Jan Staněk
on 2015-05-19 09:01:20 UTC
(
hide
)
Description:
Upstream patch for the 4.7.25 version
Filename:
MIME Type:
Creator:
Jan Staněk
Created:
2015-05-19 09:01:20 UTC
Size:
5.25 KB
patch
obsolete
>Only in db-4.7.25_orig/build_unix: tags >Only in db-4.7.25: memp_stat_4.7.25.diff >diff -u -r db-4.7.25_orig/mp/mp_stat.c db-4.7.25/mp/mp_stat.c >--- db-4.7.25_orig/mp/mp_stat.c 2008-01-09 04:58:42.000000000 +0800 >+++ db-4.7.25/mp/mp_stat.c 2015-05-18 17:07:39.000000000 +0800 >@@ -88,6 +88,13 @@ > u_int32_t tmp_wait, tmp_nowait; > int ret; > >+ /* >+ * The array holding the lengths related to the buffer allocated for *fspp. >+ * The first element of the array holds the number of entries allocated. >+ * The second element of the array holds the total number of bytes allocated. >+ */ >+ u_int32_t fsp_len[2]; >+ > dbmp = env->mp_handle; > mp = dbmp->reginfo[0].primary; > >@@ -200,31 +207,53 @@ > if (fspp != NULL) { > *fspp = NULL; > >- /* Count the MPOOLFILE structures. */ >- i = 0; >- len = 0; >- if ((ret = __memp_walk_files(env, >- mp, __memp_count_files, &len, &i, flags)) != 0) >- return (ret); >+ while (*fspp == NULL) { >+ /* Count the MPOOLFILE structures. */ >+ i = 0; >+ /* >+ * Allow space for the first __memp_get_files() to align the >+ * structure array to uintmax_t, DB_MPOOL_STAT's most >+ * restrictive field. [#23150] >+ */ >+ len = sizeof(uintmax_t); >+ if ((ret = __memp_walk_files(env, >+ mp, __memp_count_files, &len, &i, flags)) != 0) >+ return (ret); >+ >+ if (i == 0) >+ return (0); >+ >+ /* >+ * Copy the number of DB_MPOOL_FSTAT entries and the number of >+ * bytes allocated for them into fsp_len. Do not count the space >+ * reserved for allignment. >+ */ >+ fsp_len[0] = i; >+ fsp_len[1] = len - sizeof(uintmax_t); > >- if (i == 0) >- return (0); >- len += sizeof(DB_MPOOL_FSTAT *); /* Trailing NULL */ >+ len += sizeof(DB_MPOOL_FSTAT *); /* Trailing NULL */ > >- /* Allocate space */ >- if ((ret = __os_umalloc(env, len, fspp)) != 0) >- return (ret); >+ /* Allocate space */ >+ if ((ret = __os_umalloc(env, len, fspp)) != 0) >+ return (ret); > >- tfsp = *fspp; >- *tfsp = NULL; >+ tfsp = *fspp; >+ *tfsp = NULL; > >- /* >- * Files may have been opened since we counted, don't walk >- * off the end of the allocated space. >- */ >- if ((ret = __memp_walk_files(env, >- mp, __memp_get_files, &tfsp, &i, flags)) != 0) >- return (ret); >+ /* >+ * Files may have been opened since we counted, if we walk off >+ * the end of the allocated space specified in fsp_len, retry. >+ */ >+ if ((ret = __memp_walk_files(env, >+ mp, __memp_get_files, &tfsp, fsp_len, flags)) != 0) { >+ if (ret == DB_BUFFER_SMALL) { >+ __os_ufree(env, *fspp); >+ *fspp = NULL; >+ tfsp = NULL; >+ } else >+ return (ret); >+ } >+ } > > *++tfsp = NULL; > } >@@ -296,29 +325,36 @@ > * for the text file names. > */ > static int >-__memp_get_files(env, mfp, argp, countp, flags) >+__memp_get_files(env, mfp, argp, fsp_len, flags) > ENV *env; > MPOOLFILE *mfp; > void *argp; >- u_int32_t *countp; >+ u_int32_t fsp_len[]; > u_int32_t flags; > { > DB_MPOOL *dbmp; > DB_MPOOL_FSTAT **tfsp, *tstruct; > char *name, *tname; >- size_t nlen; >+ size_t nlen, tlen; > u_int32_t pagesize; > >- if (*countp == 0) >- return (0); >+ /* We walked through more files than argp was allocated for. */ >+ if (fsp_len[0] == 0) >+ return DB_BUFFER_SMALL; > > dbmp = env->mp_handle; > tfsp = *(DB_MPOOL_FSTAT ***)argp; > > if (*tfsp == NULL) { >- /* Add 1 to count because we need to skip over the NULL. */ >- tstruct = (DB_MPOOL_FSTAT *)(tfsp + *countp + 1); >- tname = (char *)(tstruct + *countp); >+ /* >+ * Add 1 to count because to skip over the NULL end marker. >+ * Align it further for DB_MPOOL_STAT's most restrictive field >+ * because uintmax_t might require stricter alignment than >+ * pointers; e.g., IP32 LL64 SPARC. [#23150] >+ */ >+ tstruct = (DB_MPOOL_FSTAT *)&tfsp[fsp_len[0] + 1]; >+ tstruct = ALIGNP_INC(tstruct, sizeof(uintmax_t)); >+ tname = (char *)&tstruct[fsp_len[0]]; > *tfsp = tstruct; > } else { > tstruct = *tfsp + 1; >@@ -328,12 +364,26 @@ > > name = __memp_fns(dbmp, mfp); > nlen = strlen(name) + 1; >+ >+ /* The space required for file names is larger than argp was allocated for. */ >+ tlen = sizeof(DB_MPOOL_FSTAT *) + sizeof(DB_MPOOL_FSTAT) + nlen; >+ if (fsp_len[1] < tlen) >+ return DB_BUFFER_SMALL; >+ else >+ /* Count down the number of bytes left in argp. */ >+ fsp_len[1] -= tlen; >+ > memcpy(tname, name, nlen); >- *tstruct = mfp->stat; >+ memcpy(tstruct, &mfp->stat, sizeof(mfp->stat)); > tstruct->file_name = tname; > >+ /* Grab the pagesize from the mfp. */ >+ tstruct->st_pagesize = mfp->stat.st_pagesize; >+ > *(DB_MPOOL_FSTAT ***)argp = tfsp; >- (*countp)--; >+ >+ /* Count down the number of entries left in argp. */ >+ fsp_len[0]--; > > if (LF_ISSET(DB_STAT_CLEAR)) { > pagesize = mfp->stat.st_pagesize; >diff -u -r db-4.7.25_orig/mp/mp_sync.c db-4.7.25/mp/mp_sync.c >--- db-4.7.25_orig/mp/mp_sync.c 2008-01-17 21:59:12.000000000 +0800 >+++ db-4.7.25/mp/mp_sync.c 2015-05-18 17:04:00.000000000 +0800 >@@ -57,11 +57,13 @@ > if ((t_ret = func(env, > mfp, arg, countp, flags)) != 0 && ret == 0) > ret = t_ret; >- if (ret != 0 && !LF_ISSET(DB_STAT_MEMP_NOERROR)) >+ if (ret != 0 && >+ (!LF_ISSET(DB_STAT_MEMP_NOERROR) || ret == DB_BUFFER_SMALL)) > break; > } > MUTEX_UNLOCK(env, hp->mtx_hash); >- if (ret != 0 && !LF_ISSET(DB_STAT_MEMP_NOERROR)) >+ if (ret != 0 && >+ (!LF_ISSET(DB_STAT_MEMP_NOERROR) || ret == DB_BUFFER_SMALL)) > break; > } > return (ret);
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 1211871
:
1026575
|
1027041
| 1027042