Bug 761790 (GLUSTER-58) - glusterfs_readdir() dirent struct overflow
Summary: glusterfs_readdir() dirent struct overflow
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: GLUSTER-58
Product: GlusterFS
Classification: Community
Component: libglusterfsclient
Version: mainline
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Shehjar Tikoo
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-06-25 04:45 UTC by Basavanagowda Kanur
Modified: 2009-08-13 08:06 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:
Regression: RTP
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:


Attachments (Terms of Use)

Description Basavanagowda Kanur 2009-06-25 04:45:59 UTC
[Migrated from savannah BTS] - bug 26220 [https://savannah.nongnu.org/bugs/?26220]
Sat 18 Apr 2009 05:53:13 AM GMT, original submission:

glusterfs_readdir() uses the OS dirent struct, however the values are populated from gluster's gf_dirent_t struct.

ubuntu 8.10 dirent.h:
unsigned short int d_reclen;

gf-dirent.h:
uint32_t d_len;

libglusterfsclient.c in libgf_client_readdir():
dirp->d_reclen = entry->d_len;

It appears as though the assignment would overwrite the d_type field and into the first byte of the name and then uses the truncated dirent offset to terminate the name. The result is random one letter directory names.

Attached is the source I'm testing with.

The OS dirent struct appears to be the same for the majority of *nix OS's.

The command I use to compile the code:
gcc -L/usr/local/lib/ -l glusterfsclient glfs.c

Thanks 
--------------------------------------------------------------------------------
Sat 18 Apr 2009 05:57:59 AM GMT, comment #1 by 	Rob <serialthrilla>:

Sorry, could you update this bug report to my account?

Thanks

--------------------------------------------------------------------------------
Tue 21 Apr 2009 12:11:21 PM GMT, comment #2 by 	Shehjar Tikoo <shehjart>:

Hi

What is the architecture on which you're running ubuntu?
Please paste the output of:

$ uname -a

Thanks

--------------------------------------------------------------------------------
Tue 21 Apr 2009 06:25:21 PM GMT, comment #3 by 	Rob <serialthrilla>:

uname -a:

Linux rob-desktop 2.6.27-11-generic #1 SMP Thu Jan 29 19:24:39 UTC 2009 i686 GNU/Linux

Here's a website I used to check other dirent.h files:
http://fxr.watson.org/

For CentOS 5 the dirent.h is provided by glibc-headers-2.5 which appears to be exactly the same as the Ubuntu one.

Also appears that some of the dirent fields don't exist.
Example: glibc-2.9/bits/dirent.h only has d_name and d_fileno. Other OSes only had reclen or namelen but not both.

Thanks

Comment 1 Shehjar Tikoo 2009-07-02 10:44:07 UTC
For whatever reason we're setting d_reclen member inside a dirent, this problem will not be present in releases starting from 2.0.2 since most of the directory reading code in libglusterfsclient has been revamped. The presence of d_reclen is not mandated by POSIX so now we do not even try to set it anymore.


Note You need to log in before you can comment on or make changes to this bug.