Bug 1115264 - Incorrect de-serialization leading to stream corruption in Big Endian systems
Summary: Incorrect de-serialization leading to stream corruption in Big Endian systems
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: compress-lzf
Version: 20
Hardware: All
OS: All
unspecified
high
Target Milestone: ---
Assignee: gil cattaneo
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-07-02 05:00 UTC by IBM Bug Proxy
Modified: 2014-08-04 14:04 UTC (History)
4 users (show)

Fixed In Version: compress-lzf-0.9.8-2.fc20
Clone Of:
Environment:
Last Closed: 2014-07-11 02:02:16 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
testcase (1.22 KB, application/octet-stream)
2014-07-02 05:00 UTC, IBM Bug Proxy
no flags Details
call stack (4.02 KB, application/octet-stream)
2014-07-02 05:00 UTC, IBM Bug Proxy
no flags Details
[RFC Patch] Fix SUID issue in LZF compression. (1.67 KB, text/plain)
2014-07-02 05:00 UTC, IBM Bug Proxy
no flags Details


Links
System ID Private Priority Status Summary Last Updated
IBM Linux Technology Center 111797 0 None None None Never

Description IBM Bug Proxy 2014-07-02 05:00:25 UTC

Comment 1 IBM Bug Proxy 2014-07-02 05:00:27 UTC
== Comment: #0 - Kamalesh Babulal <kamaleshb.com> - 2014-06-17 05:25:06 ==
Attached test case (runnable in a SPARK environment using hadoop libraries in the classpath, can provide a stand-alone test case if need be) fails with an error: 
java.io.InvalidClassException: org.apache.spark.SerializableWritable; local class incompatible: stream classdesc serialVersionUID = 6301214776158303468, local class serialVersionUID = -7785455416944904980

This issue has been reported upstream also https://github.com/ning/compress/issues/37
(attached the call-stack)

== Comment: #2 - Kamalesh Babulal <kamaleshb.com> - 2014-06-17 05:34:10 ==
LZF compression algorithm compress in-memory streams, which is endian-specific. Peer class UnsafeChunkEncoderLE has a fool-proof compression logic, while UnsafeChunkEncoderBE.java incorrectly computes the distance between two byte sequences in the stream, leading to corrupting the serialVersionUID field of the object data. This patch fixes the issue UnsafeChunkEncoderBE.java.

We tired this patch locally and it resolves the issue.

Comment 2 IBM Bug Proxy 2014-07-02 05:00:42 UTC
Created attachment 913983 [details]
testcase

default comment by bridge

Comment 3 IBM Bug Proxy 2014-07-02 05:00:44 UTC
Created attachment 913984 [details]
call stack

default comment by bridge

Comment 4 IBM Bug Proxy 2014-07-02 05:00:46 UTC
Created attachment 913985 [details]
[RFC Patch] Fix SUID issue in LZF compression.

default comment by bridge

Comment 5 gil cattaneo 2014-07-02 08:44:32 UTC
Thanks for the patch
should be resolved in compress-lzf-0.9.8-2.fc20 compress-lzf-0.9.8-3.fc21

Comment 6 Fedora Update System 2014-07-02 08:48:49 UTC
compress-lzf-0.9.8-2.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/compress-lzf-0.9.8-2.fc20

Comment 7 Fedora Update System 2014-07-03 04:05:32 UTC
Package compress-lzf-0.9.8-2.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing compress-lzf-0.9.8-2.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-8014/compress-lzf-0.9.8-2.fc20
then log in and leave karma (feedback).

Comment 8 Fedora Update System 2014-07-11 02:02:16 UTC
compress-lzf-0.9.8-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 IBM Bug Proxy 2014-08-04 13:50:54 UTC
------- Comment From kamaleshb.com 2014-08-04 13:48 EDT-------
Can you please let us know, if this patch is consider for Fedora21 ?

Comment 10 gil cattaneo 2014-08-04 14:00:21 UTC
(In reply to IBM Bug Proxy from comment #9)
> ------- Comment From kamaleshb.com 2014-08-04 13:48 EDT-------
> Can you please let us know, if this patch is consider for Fedora21 ?
Was applied also for F20
http://pkgs.fedoraproject.org/cgit/compress-lzf.git/


Note You need to log in before you can comment on or make changes to this bug.