bugmldonkey, a multi-networks file-sharing client - Bugs: bug #1173, array bounds violations in latest...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #1173: array bounds violations in latest CVS on OS X 10.2 -> SIGBUS

Submitted by:  None
Submitted on:  Tue 10 Sep 2002 01:58:37 PM UTC  
 
Category: eDonkey-PluginSeverity: 3 - Normal
Item Group: Segmentation FaultStatus: Remind
Assigned to: mldonkey admin <mldonkey>Open/Closed: Closed
Release: Release: 1.99 beta
Operating System: Mac OS X 10.3Binaries Origin: CVS / Self compiled
CPU type: None

Mon 03 Mar 2003 10:48:51 PM UTC, comment #3:

Use 2.02-25 from CVS. It is a bug from ocaml.

mldonkey admin <mldonkey>
Project AdministratorIn charge of this item.
Thu 19 Sep 2002 06:35:26 PM UTC, comment #2:

The question is: how to find the correct size of the file ? There are currently no way to get the size of a file from the servers or clients just knowing its MD4 hash.

Maybe the temporary fix would be to check the size of the chunks before accessing file_chunks, but it doesn't explain the SIGBUS, since ocaml checks the size of the array before accessing it.

mldonkey admin <mldonkey>
Project AdministratorIn charge of this item.
Wed 11 Sep 2002 02:26:40 AM UTC, comment #1:

there are problems if the on-disk file size of a recovered file is
different from the file-size known on the donkey network: loops
from 0 to file.file_nchunks end up having too few network chunks,
and the recovery can also lead to file.file_nchunks and the length
of the file.file_chunks array differing. if the index is larger than
the array, mldonkey dies with SIGBUS on the mac os x 10.2 ppc platform.

if one does recover_temp and a file is recovered that had been put
into pause state because there was insufficient disk space to grow
the on-disk file to the full size found when starting the file download
in the first place, the current code will have a permanent disagreement
between what the donkey network believes is the file size, and what
the local mldonkey believes is the filesize. this leads to program crashes.

a fix should recognize that the on-disk file size is NOT canonical in
some circumstances, and that in those circumstances, the on-disk
chunks should be tested to see if they are PresentValid. however,
the test should either grow the file to the network's idea of the
file size, or it should stop at disk-file EOF. in either case, the
state held about the file size (and related info such as file.file_nchunks
and the chunk arrays) should be updated to a correct network size.

one possible approach might be to have a zombie file state which
recover_temp uses until it gets a "consensus view" about the
proper file size for a given MD4 file from the donkey network,
then do the size bookkeeping, then run the file through the current
recover_temp process. or, "step 1: synthesize (or search) an ed2k:// link. step2:
start a download on that link. step 3: validate the on-disk data, as
if it arrived after step 2.".

Anonymous
Tue 10 Sep 2002 01:58:37 PM UTC, original submission:

hi -

there are cases where loops across file.file_nchunks in
donkey/donkeyOneFile.ml and donkey/donkeyClient.ml
fail because the loop index is used to reference arrays
that are not long enough.

e.g., (Array.length file.file_chunks) != file.file_nchunks
or (Array.length chunks) != (Array.length file.file_chunks)

this is easily triggered by removing files.ini and history.met,
restart, and "recover_temp". entries in files.ini with "file_length = 0"
will also cause SIGBUS crashes because of array bounds problems throughout
the formerly secret code.

no fix yet, but lots of interesting stuff learned via Printf.printf / printf_string
sprinkled liberally...

why is this a problem in os x 10.2 and not other architectures/operating-systems,
including os x 10.1 & os x 10.0?

-- rottegift

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 7 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 03 Mar 2003 10:48:51 PM UTCmldonkeyOpen/ClosedOpen=>(Error - Not Found)
Thu 19 Sep 2002 06:35:26 PM UTCmldonkeyCategoryNone=>(Error - Not Found)
  Item GroupNone=>(Error - Not Found)
  StatusNone=>(Error - Not Found)
  Assigned toNone=>NA
  ReleaseNone=>(Error - Not Found)
  Operating SystemNone=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1