Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Verify existence of metadata marker #102

Closed
wants to merge 1 commit into from
Closed

Verify existence of metadata marker #102

wants to merge 1 commit into from

Conversation

stoeckmann
Copy link
Contributor

The current code does not properly check if there is at least one
marker inside the database. If there is no marker available, the
initial search area will be considered as a valid metadata start,
which possibly leads to out of boundary access due to offset addition.

An example would be a database file with only one byte in it (1 byte is
needed for a successful mmap call). This statement would lead to
out of boundary access later on (file_size is 1):

*metadata_start = search_area + strlen(METADATA_MARKER);

Also, if there are multiple markers in the metadata area, use the
last one encountered. The old code looks like that was intended.

PS: Also keep in mind that the calculation of metadata size is not
correct. The pointer increments by strlen(METADATA_MARKER),
but the size is not reduced. The later code does not keep that in
mind, therefore it should be taken into account here.

The current code does not properly check if there is at least one
marker inside the database. If there is no marker available, the
initial search area will be considered as a valid metadata start,
which possibly leads to out of boundary access due to offset addition.

An example would be a database file with only one byte in it (1 byte is
needed for a successful mmap call). This statement would lead to
out of boundary access later on (file_size is 1):

    *metadata_start = search_area + strlen(METADATA_MARKER);

Also, if there are multiple markers in the metadata area, use the
last one encountered. The old code looks like that was intended.
@autarch
Copy link
Contributor

autarch commented Jan 5, 2016

I merged this from the command line. Thanks!

@autarch autarch closed this Jan 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants