bugGluster - Bugs: bug #26220, glusterfs_readdir() dirent struct...

 
 

bug #26220: glusterfs_readdir() dirent struct overflow

Submitted by:  None
Submitted on:  Sat 18 Apr 2009 05:53:13 AM UTC  
 
Category: GlusterFSSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Crash
Status: PostponedPrivacy: Public
Assigned to: Shehjar Tikoo <shehjart>Originator Name: serialthrilla
Originator Email: -unavailable-Open/Closed: Closed
Release: gitOperating System: GNU/Linux
Reproducibility: Every Time

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 25 Jun 2009 04:46:52 AM UTC, comment #4:

This bug has been moved to http://bugs.gluster.com

Please track the progress of the bug at http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=58

--
Gowda

Basavanagowda Kanur <gowda>
Project Member
Tue 21 Apr 2009 06:25:21 PM UTC, comment #3:

uname -a:

Linux rob-desktop 2.6.27-11-generic #1 SMP Thu Jan 29 19:24:39 UTC 2009 i686 GNU/Linux

Here's a website I used to check other dirent.h files:
http://fxr.watson.org/

For CentOS 5 the dirent.h is provided by glibc-headers-2.5 which appears to be exactly the same as the Ubuntu one.

Also appears that some of the dirent fields don't exist.
Example: glibc-2.9/bits/dirent.h only has d_name and d_fileno. Other OSes only had reclen or namelen but not both.

Thanks

Rob <serialthrilla>
Tue 21 Apr 2009 12:11:21 PM UTC, comment #2:

Hi

What is the architecture on which you're running ubuntu?
Please paste the output of:

$ uname -a

Thanks

Shehjar Tikoo <shehjart>
Project MemberIn charge of this item.
Sat 18 Apr 2009 05:57:59 AM UTC, comment #1:

Sorry, could you update this bug report to my account?

Thanks

Rob <serialthrilla>
Sat 18 Apr 2009 05:53:13 AM UTC, original submission:

glusterfs_readdir() uses the OS dirent struct, however the values are populated from gluster's gf_dirent_t struct.

ubuntu 8.10 dirent.h:
unsigned short int d_reclen;

gf-dirent.h:
uint32_t d_len;

libglusterfsclient.c in libgf_client_readdir():
dirp->d_reclen = entry->d_len;

It appears as though the assignment would overwrite the d_type field and into the first byte of the name and then uses the truncated dirent offset to terminate the name. The result is random one letter directory names.

Attached is the source I'm testing with.

The OS dirent struct appears to be the same for the majority of *nix OS's.

The command I use to compile the code:
gcc -L/usr/local/lib/ -l glusterfsclient glfs.c

Thanks

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #17945:  glfs.c.txt added by None (2KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gowda (Posted a comment)
  • -unavailable- added by shehjart (Posted a comment)
  • -unavailable- added by serialthrilla (Posted a comment)
  • -unavailable- added by serialthrilla
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 25 Jun 2009 04:46:52 AM UTCgowdaStatusNone=>Postponed
      Open/ClosedOpen=>Closed
    Tue 21 Apr 2009 12:11:21 PM UTCshehjartAssigned toNone=>shehjart
      Originator Name=>serialthrilla
      Originator Email=>-unavailable-
    Sat 18 Apr 2009 05:56:58 AM UTCserialthrillaCarbon-Copy-=>Added -unavailable-
    Sat 18 Apr 2009 05:53:13 AM UTCNoneAttached File-=>Added glfs.c.txt, #17945

    Back to the top


    Powered by Savane 3.1-cleanup1