sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-26 10:04:02 +03:00
Code

tdb: Fix a tdb corruption

Browse Source 
tdb_purge_dead can change the next pointer of "rec" if we purge the record
right behind the current record to be deleted. Just overwrite the magic,
not the whole record with stale data.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Volker Lendecke 2014-03-16 20:08:32 +00:00 committed by Michael Adam
parent 9c9df40220
commit 5f7b481349
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/tdb/common/tdb.c
View File

@ -394,6 +394,8 @@ static int tdb_delete_hash(struct tdb_context *tdb, TDB_DATA key, uint32_t hash)
if (tdb->max_dead_records != 0) {
uint32_t magic = TDB_DEAD_MAGIC;
/*
* Allow for some dead records per hash chain, mainly for
* tdb's with a very high create/delete rate like locking.tdb.
@ -410,8 +412,9 @@ static int tdb_delete_hash(struct tdb_context *tdb, TDB_DATA key, uint32_t hash)
/*
* Just mark the record as dead.
*/
rec.magic = TDB_DEAD_MAGIC;
ret = tdb_rec_write(tdb, rec_ptr, &rec);
ret = tdb_ofs_write(
tdb, rec_ptr + offsetof(struct tdb_record, magic),
&magic);
}
else {
ret = tdb_do_delete(tdb, rec_ptr, &rec);