You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Christof Meerald <cm...@web.de> on 2004/02/11 19:07:53 UTC

Segmentation fault in dav_svn_get_txn

Hi,

I have discovered a segmentation fault in 
subversion/mod_dav_svn/activity.c (Subversion 0.37.0) in function 
dav_svn_get_txn. It unconditionally invokes apr_dbm_freedatum(dbm, 
value) even if value hasn't been initialized. Obviously, the call to 
apr_dbm_freedatum should be moved up two lines (just after the 
apr_pstrdup). Here is the fixed version:

const char *dav_svn_get_txn(const dav_svn_repos *repos,
                            const char *activity_id)
{
  apr_dbm_t *dbm;
  apr_status_t status;
  const char *pathname;
  apr_datum_t key;
  apr_datum_t value;
  const char *txn_name = NULL;

  pathname = svn_path_join(repos->fs_path, ACTIVITY_DB, repos->pool);
  status = apr_dbm_open(&dbm, pathname, APR_DBM_READONLY,
                        APR_OS_DEFAULT, repos->pool);
  if (status != APR_SUCCESS)
    {
      /* ### let's just assume that any error means the DB doesn't exist,
         ### therefore, the activity/transaction doesn't exist */
      return NULL;
    }

  key.dptr = (char *)activity_id;
  key.dsize = strlen(activity_id) + 1;  /* null-term'd */
  if (apr_dbm_exists(dbm, key))
    {
      status = apr_dbm_fetch(dbm, key, &value);
      if (status != APR_SUCCESS)
        {
          /* ### again: assume failure means it doesn't exist */
          apr_dbm_close(dbm);
          return NULL;
        }
      txn_name = apr_pstrdup(repos->pool, value.dptr);   /* null-term'd */
      apr_dbm_freedatum(dbm, value);
    }

  apr_dbm_close(dbm);

  return txn_name;
}


bye, Christof

-- 
http://cmeerw.org
mailto cmeerw at web.de


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: Segmentation fault in dav_svn_get_txn

Posted by "C. Michael Pilato" <cm...@collab.net>.
Christof Meerald <cm...@web.de> writes:

> Hi,
> 
> I have discovered a segmentation fault in
> subversion/mod_dav_svn/activity.c (Subversion 0.37.0) in function
> dav_svn_get_txn. It unconditionally invokes apr_dbm_freedatum(dbm,
> value) even if value hasn't been initialized. Obviously, the call to
> apr_dbm_freedatum should be moved up two lines (just after the
> apr_pstrdup). Here is the fixed version:

Thanks, Christof.  It's generally better to mail patches, but this fix
was simple enought to describe in prose (as you did), so I decided not
to give you a hard time about it. :-)

You may see the fruits of your debugging labor in revision 8618.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: Segmentation fault in dav_svn_get_txn

Posted by Ben Collins-Sussman <su...@collab.net>.
On Wed, 2004-02-11 at 15:03, Christof Meerwald wrote:

> svn co http://server/test test
> cd test
> svn propset svn:ignore a1 .
> svn -m1 commit
> svn propedit .
> svn -m2 commit (server segfaults)

Hm, I assume your propedit line should have a "svn:ignore" in there?

I can't make apache segfault with this recipe.  What is it about this
recipe that stimulates the bug for you?



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: Segmentation fault in dav_svn_get_txn

Posted by Christof Meerwald <cm...@web.de>.
On Wed, Feb 11, 2004 at 01:24:26PM -0600, Ben Collins-Sussman wrote:
> On Wed, 2004-02-11 at 13:07, Christof Meerald wrote:
> > I have discovered a segmentation fault in 
> > subversion/mod_dav_svn/activity.c 
> Thanks for spotting this bug... in the future, can you send a patch (in
> unified diff), so that we don't have to spot the code change ourselves?
> 
> Also:  can you tell us how you discovered the bug?  Is there some
> reproduction recipe?

Here is a reproduction recipe:

svnadmin create test (on the server)

svn co http://server/test test
cd test
svn propset svn:ignore a1 .
svn -m1 commit
svn propedit .
svn -m2 commit (server segfaults)


bye, Christof

-- 
http://cmeerw.org                                 JID: cmeerw@jabber.at
mailto cmeerw at web.de

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: Segmentation fault in dav_svn_get_txn

Posted by Ben Collins-Sussman <su...@collab.net>.
On Wed, 2004-02-11 at 13:07, Christof Meerald wrote:
> Hi,
> 
> I have discovered a segmentation fault in 
> subversion/mod_dav_svn/activity.c 

Thanks for spotting this bug... in the future, can you send a patch (in
unified diff), so that we don't have to spot the code change ourselves?

Also:  can you tell us how you discovered the bug?  Is there some
reproduction recipe?



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org