You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Andrew Stitcher (JIRA)" <ji...@apache.org> on 2014/01/16 20:57:22 UTC
[jira] [Reopened] (QPID-5486) Creating paged queue can overwrite
existing qpidd files
[ https://issues.apache.org/jira/browse/QPID-5486?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Andrew Stitcher reopened QPID-5486:
-----------------------------------
This change as submitted is actually racy.
Instead of adding a ::access() system call all you need to do is change O_TRUNC for O_EXCL in the open flags. That will forbid the ::open system call from creating the file if it already exists.
(TRUNC is only useful if you are opening an existing file as it will truncate it to 0 size)
> Creating paged queue can overwrite existing qpidd files
> -------------------------------------------------------
>
> Key: QPID-5486
> URL: https://issues.apache.org/jira/browse/QPID-5486
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: 0.24
> Reporter: Pavel Moravec
> Assignee: Pavel Moravec
> Priority: Trivial
> Labels: easy, easyfix, easytest, patch
> Fix For: 0.27
>
> Original Estimate: 1h
> Remaining Estimate: 1h
>
> Description of problem:
> When creating paged queue, there is no check whether the file /var/lib/qpidd/<queue_name> exists or not. Hence it is possible to rewrite files like "lock" or "systemId" there.
> (Severity of the bug depends on importance of these files for the broker, that apparently is fine to be started with the files overwritten)
> Note that creating a file named e.g. "rhm" (that is directory in /var/lib/qpidd) is disallowed even now.
> Version-Release number of selected component (if applicable):
> 0.27 (current upstream)
> How reproducible:
> 100%
> Steps to Reproduce:
> qpid-send -a "lock; {create:always, delete:always, node: { x-declare: {arguments: {'qpid.paging':'True' }}}}"
> echo $?
> qpid-send -a "systemId; {create:always, delete:always, node: { x-declare: {arguments: {'qpid.paging':'True' }}}}"
> echo $?
> Actual results:
> 0
> 0
> Expected results:
> Both should return an error like:
> qpid-send: framing-error: Attempting to re-write file /home/pmoravec/.qpidd/systemId for paged queue "systemId" (/home/pmoravec/qpid-trunk/qpid/cpp/src/qpid/sys/posix/MemoryMappedFile.cpp:68)
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org