zsh-workers
 help / color / mirror / code / Atom feed
* [BUG] [PATCH] zsh/db/gdbm does unnecessary "+1" to strlen()
@ 2017-02-06 23:46 Sebastian Gniazdowski
  0 siblings, 0 replies; only message in thread
From: Sebastian Gniazdowski @ 2017-02-06 23:46 UTC (permalink / raw)
  To: zsh-workers

[-- Attachment #1: Type: text/plain, Size: 2352 bytes --]

Hello
If I create gdbm hash and key:

ztie -d db/gdbm -f database.zsh mybase
mybase[xyz]=1

then gdbmtool shows:

gdbmtool> list
xyz\000 1\000

Creating such entry via gdbmtool itself doesn't result in the "\000" at
the end.

The patch removes buffer overruns that cause that. It's "+ 1" to data
length when storing, retrieving. That's why it's not possible to
retrieve key "abc" from Zsh if it's created in gdbmtool, etc.

I've recorded both good and bad symptoms on Asciinema. QUALITY
recording, really, almost no mistake, 1:21 sec:

https://asciinema.org/a/5smfk0hdviy8nien4n75isj4a

MORE: unpatched gdbm module **sucks environment, widgets into the
database** (29 sec):

https://asciinema.org/a/12ffm5ltpj9udnmradtat17am

Here is my attempt on pasting the patch, hopefully Fastmail won't break
whitespaces. Also attached.

diff --git a/Src/Modules/db_gdbm.c b/Src/Modules/db_gdbm.c
index 8dd60fc..310e329 100644
--- a/Src/Modules/db_gdbm.c
+++ b/Src/Modules/db_gdbm.c
@@ -170,7 +170,7 @@ gdbmgetfn(Param pm)
     GDBM_FILE dbf;
 
     key.dptr = pm->node.nam;
-    key.dsize = strlen(key.dptr) + 1;
+    key.dsize = strlen(key.dptr);
 
     dbf = (GDBM_FILE)(pm->u.hash->tmpdata);
     ret = gdbm_exists(dbf, key);
@@ -191,9 +191,9 @@ gdbmsetfn(Param pm, char *val)
     GDBM_FILE dbf;
 
     key.dptr = pm->node.nam;
-    key.dsize = strlen(key.dptr) + 1;
+    key.dsize = strlen(key.dptr);
     content.dptr = val;
-    content.dsize = strlen(content.dptr) + 1;
+    content.dsize = strlen(content.dptr);
 
     dbf = (GDBM_FILE)(pm->u.hash->tmpdata);
     (void)gdbm_store(dbf, key, content, GDBM_REPLACE);
@@ -207,7 +207,7 @@ gdbmunsetfn(Param pm, UNUSED(int um))
     GDBM_FILE dbf;
 
     key.dptr = pm->node.nam;
-    key.dsize = strlen(key.dptr) + 1;
+    key.dsize = strlen(key.dptr);
 
     dbf = (GDBM_FILE)(pm->u.hash->tmpdata);
     (void)gdbm_delete(dbf, key);
@@ -302,12 +302,12 @@ gdbmhashsetfn(Param pm, HashTable ht)
 	    v.pm = (Param) hn;
 
 	    key.dptr = v.pm->node.nam;
-           key.dsize = strlen(key.dptr) + 1;
+           key.dsize = strlen(key.dptr);
 
 	    queue_signals();
 
 	    content.dptr = getstrvalue(&v);
-           content.dsize = strlen(content.dptr) + 1;
+           content.dsize = strlen(content.dptr);
 
 	    (void)gdbm_store(dbf, key, content, GDBM_REPLACE);      
 

-- 
  Sebastian Gniazdowski

[-- Attachment #2: gdbm_pone.diff --]
[-- Type: text/plain, Size: 1467 bytes --]

diff --git a/Src/Modules/db_gdbm.c b/Src/Modules/db_gdbm.c
index 8dd60fc..310e329 100644
--- a/Src/Modules/db_gdbm.c
+++ b/Src/Modules/db_gdbm.c
@@ -170,7 +170,7 @@ gdbmgetfn(Param pm)
     GDBM_FILE dbf;
 
     key.dptr = pm->node.nam;
-    key.dsize = strlen(key.dptr) + 1;
+    key.dsize = strlen(key.dptr);
 
     dbf = (GDBM_FILE)(pm->u.hash->tmpdata);
     ret = gdbm_exists(dbf, key);
@@ -191,9 +191,9 @@ gdbmsetfn(Param pm, char *val)
     GDBM_FILE dbf;
 
     key.dptr = pm->node.nam;
-    key.dsize = strlen(key.dptr) + 1;
+    key.dsize = strlen(key.dptr);
     content.dptr = val;
-    content.dsize = strlen(content.dptr) + 1;
+    content.dsize = strlen(content.dptr);
 
     dbf = (GDBM_FILE)(pm->u.hash->tmpdata);
     (void)gdbm_store(dbf, key, content, GDBM_REPLACE);
@@ -207,7 +207,7 @@ gdbmunsetfn(Param pm, UNUSED(int um))
     GDBM_FILE dbf;
 
     key.dptr = pm->node.nam;
-    key.dsize = strlen(key.dptr) + 1;
+    key.dsize = strlen(key.dptr);
 
     dbf = (GDBM_FILE)(pm->u.hash->tmpdata);
     (void)gdbm_delete(dbf, key);
@@ -302,12 +302,12 @@ gdbmhashsetfn(Param pm, HashTable ht)
 	    v.pm = (Param) hn;
 
 	    key.dptr = v.pm->node.nam;
-	    key.dsize = strlen(key.dptr) + 1;
+	    key.dsize = strlen(key.dptr);
 
 	    queue_signals();
 
 	    content.dptr = getstrvalue(&v);
-	    content.dsize = strlen(content.dptr) + 1;
+	    content.dsize = strlen(content.dptr);
 
 	    (void)gdbm_store(dbf, key, content, GDBM_REPLACE);	
 

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2017-02-06 23:46 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-06 23:46 [BUG] [PATCH] zsh/db/gdbm does unnecessary "+1" to strlen() Sebastian Gniazdowski

Code repositories for project(s) associated with this public inbox

	https://git.vuxu.org/mirror/zsh/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).