[PATCH 1/2] tdb: don't corrupt database if we go overlength due to transaction expand.

[Volker Lendecke]

On Tue, May 28, 2013 at 04:53:55PM +0930, Rusty Russell wrote:
> See http://permalink.gmane.org/gmane.network.samba.internals/42906 for
> an example of what happens.
> 
> Signed-off-by: Rusty Russell <rusty at rustcorp.com.au>
> ---
>  lib/tdb/common/io.c           |   4 ++
>  lib/tdb/common/transaction.c  |   5 ++
>  lib/tdb/test/run-overlength.c | 146 ++++++++++++++++++++++++++++++++++++++++++
>  lib/tdb/wscript               |   4 +-
>  4 files changed, 158 insertions(+), 1 deletion(-)
>  create mode 100644 lib/tdb/test/run-overlength.c
> 
> diff --git a/lib/tdb/common/io.c b/lib/tdb/common/io.c
> index 7e29c38..60f1d49 100644
> --- a/lib/tdb/common/io.c
> +++ b/lib/tdb/common/io.c
> @@ -364,6 +364,10 @@ tdb_off_t tdb_expand_adjust(tdb_off_t map_size, tdb_off_t size, int page_size)
>  	   least 25% more space. if the DB is smaller than 100MiB,
>  	   otherwise grow it by 10% only. */
>  	if (map_size > 100 * 1024 * 1024) {
> +		/* Beware overflow! */
> +		if ((tdb_off_t)(map_size * 1.10) < map_size) {
> +			return 0xFFFFFFFF;
> +		}

Wouldn't you want to set this to the highest possible value
in this case? I could imagine there would be cases where we
can't use the full 4GB with this in place.

Volker

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt at sernet.de