Skip to Content.
Sympa Menu

freetds - Serious bug in read.c causing lockups identified.

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Gene Sokolov" <hook AT akmos.ru>
  • To: <freetds AT franklin.oit.unc.edu>
  • Subject: Serious bug in read.c causing lockups identified.
  • Date: Mon, 8 Jan 2001 17:36:41 +0300


There is a serious bug in read.c which can make FreeTDS lock up or eat file
descriptors.

char *tds_get_n(TDSSOCKET *tds, void *dest, int need)
{
....
while (need>have) {
/* We need more than is in the buffer, copy what is there */
if (dest!=NULL) {
memcpy((char*)dest+pos, tds->in_buf+tds->in_pos, have);
}
pos+=have;
need-=have;
tds_read_packet(tds);

have=tds->in_len;
}
....
}

If the socket is unexpectedly closed while tds_read_packet(tds)
is reading, the tds->in_len contains 0. The while() obviously never ends.
TDS locks up.

The module token.c calls tds_get_n but also never checks the socket state.
If tds_get_n is fixed to check for the closed socket, the locking up just
moves up one layer. If token.c is fixed, the socket condition is not checked
higher. This is a serious design flaw and a huge source of unexpected
failures.

Gene Sokolov.





  • Serious bug in read.c causing lockups identified., Gene Sokolov, 01/08/2001

Archive powered by MHonArc 2.6.24.

Top of Page