[dm-devel] Segment fault in datastruct/hash.c

[Xinwei Hu]

Hi all,

  Found by Anders Johansson <ajohansson at novell.com>, vgscan may
segment in datastruct/hash.c at
memcmp(key, (*c)->key, len). It happens because the (*c)->key is much
shorter than the key, and the
memory area following (*c)->key is unaccessable at the time.

(gdb) p (*c)->key
$1 = 0x80229fb4 "/dev/disk/by-id/ccw-LXD332"
(gdb) x/80cb 0x80229fb4
0x80229fb4:	47 '/'	100 'd'	101 'e'	118 'v'	47 '/'	100 'd'	105 'i'	115 's'
0x80229fbc:	107 'k'	47 '/'	98 'b'	121 'y'	45 '-'	105 'i'	100 'd'	47 '/'
0x80229fc4:	99 'c'	99 'c'	119 'w'	45 '-'	76 'L'	88 'X'	68 'D'	51 '3'
0x80229fcc:	51 '3'	50 '2'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'
0x80229fd4:	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'
0x80229fdc:	0 '\0'	0 '\0'	0 '\0'	49 '1'	0 '\0'	0 '\0'	0 '\0'	0 '\0'
0x80229fe4:	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'
0x80229fec:	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'
0x80229ff4:	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'	0 '\0'
0x80229ffc:	0 '\0'	0 '\0'	0 '\0'	0 '\0'	Cannot access memory at
address 0x8022a000

  I generate a patch against the latest git tree. Please consider it
for inclusion.

  Thanks.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hash.diff
Type: text/x-patch
Size: 543 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/dm-devel/attachments/20091028/9be122f4/attachment.bin>