Fossil SCM

Update SQLite to the version that avoids opening databases on file descriptor 2 and that works inside a chroot jail. Fix a potential uninitialized variable in the CGI processing.

drh 2013-08-30 06:22 UTC trunk
Commit 98b16c72c72a0cd0e9eef9369c85af308f90a448
Parent 320f14363e1a37d…
3 files changed +1 -1 +13 -28 +1 -1
~ src/cgi.c ~ src/sqlite3.c ~ src/sqlite3.h
M src/cgi.c
+1 -1
--- src/cgi.c
+++ src/cgi.c
@@ -863,12 +863,12 @@
863863
 g.zIpAddr = mprintf("%s", z);
864864
 }
865865
866866
 len = atoi(PD("CONTENT_LENGTH", "0"));
867867
 g.zContentType = zType = P("CONTENT_TYPE");
868
+ blob_zero(&g.cgiIn);
868869
 if( len>0 && zType ){
869
- blob_zero(&g.cgiIn);
870870
 if( fossil_strcmp(zType,"application/x-www-form-urlencoded")==0
871871
 || strncmp(zType,"multipart/form-data",19)==0 ){
872872
 z = fossil_malloc( len+1 );
873873
 len = fread(z, 1, len, g.httpIn);
874874
 z[len] = 0;
875875
--- src/cgi.c
+++ src/cgi.c
@@ -863,12 +863,12 @@
863 g.zIpAddr = mprintf("%s", z);
864 }
865
866 len = atoi(PD("CONTENT_LENGTH", "0"));
867 g.zContentType = zType = P("CONTENT_TYPE");
 
868 if( len>0 && zType ){
869 blob_zero(&g.cgiIn);
870 if( fossil_strcmp(zType,"application/x-www-form-urlencoded")==0
871 || strncmp(zType,"multipart/form-data",19)==0 ){
872 z = fossil_malloc( len+1 );
873 len = fread(z, 1, len, g.httpIn);
874 z[len] = 0;
875
--- src/cgi.c
+++ src/cgi.c
@@ -863,12 +863,12 @@
863 g.zIpAddr = mprintf("%s", z);
864 }
865
866 len = atoi(PD("CONTENT_LENGTH", "0"));
867 g.zContentType = zType = P("CONTENT_TYPE");
868 blob_zero(&g.cgiIn);
869 if( len>0 && zType ){
 
870 if( fossil_strcmp(zType,"application/x-www-form-urlencoded")==0
871 || strncmp(zType,"multipart/form-data",19)==0 ){
872 z = fossil_malloc( len+1 );
873 len = fread(z, 1, len, g.httpIn);
874 z[len] = 0;
875
M src/sqlite3.c
+13 -28
--- src/sqlite3.c
+++ src/sqlite3.c
@@ -656,11 +656,11 @@
656656
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
657657
 ** [sqlite_version()] and [sqlite_source_id()].
658658
 */
659659
 #define SQLITE_VERSION "3.8.1"
660660
 #define SQLITE_VERSION_NUMBER 3008001
661
-#define SQLITE_SOURCE_ID "2013-08-29 23:36:49 30d38cc44904d93508b87e373b2f45d5f93e556b"
661
+#define SQLITE_SOURCE_ID "2013-08-30 06:20:23 d9c018f8155ab48df8e0e02519bba50588fe49fc"
662662
663663
 /*
664664
 ** CAPI3REF: Run-Time Library Version Numbers
665665
 ** KEYWORDS: sqlite3_version, sqlite3_sourceid
666666
 **
@@ -23594,35 +23594,10 @@
2359423594
 if( aSyscall[i].pCurrent!=0 ) return aSyscall[i].zName;
2359523595
 }
2359623596
 return 0;
2359723597
 }
2359823598
23599
-/*
23600
-** If fd is a file descriptor that would be dangerous to use for an
23601
-** ordinary file, the close it, reopen it as /dev/null to get it out
23602
-** of the way, then return true.
23603
-**
23604
-** If fd is safe, return 0.
23605
-**
23606
-** It is dangerous to have a database file open of file descriptors 1 or
23607
-** 2 because those normally mean standard output and standard error. Other
23608
-** components of the system might write directly to those file descriptors
23609
-** and overwrite parts of the database file. Something like this happened
23610
-** on 2013-08-29 to the canonical Fossil repository when some error caused
23611
-** the database file to be opened on file descriptor 2 and later an assert()
23612
-** fired and wrote error message text into file descriptor 2, corrupting
23613
-** the repository.
23614
-*/
23615
-static int isReservedFd(int fd, const char *z, int f, int m){
23616
- if( fd<0 || fd>2 ) return 0;
23617
- sqlite3_log(SQLITE_WARNING,
23618
- "attempt to open \"%s\" as file descriptor %d", z, fd);
23619
- osClose(fd);
23620
- (void)osOpen("/dev/null",f,m);
23621
- return 1;
23622
-}
23623
-
2362423599
 /*
2362523600
 ** Invoke open(). Do so multiple times, until it either succeeds or
2362623601
 ** fails for some reason other than EINTR.
2362723602
 **
2362823603
 ** If the file creation mode "m" is 0 then set it to the default for
@@ -23639,17 +23614,27 @@
2363923614
 ** recover the hot journals.
2364023615
 */
2364123616
 static int robust_open(const char *z, int f, mode_t m){
2364223617
 int fd;
2364323618
 mode_t m2 = m ? m : SQLITE_DEFAULT_FILE_PERMISSIONS;
23644
- do{
23619
+ while(1){
2364523620
 #if defined(O_CLOEXEC)
2364623621
 fd = osOpen(z,f|O_CLOEXEC,m2);
2364723622
 #else
2364823623
 fd = osOpen(z,f,m2);
2364923624
 #endif
23650
- }while( (fd<0 && errno==EINTR) || isReservedFd(fd,z,f,m2) );
23625
+ if( fd<0 ){
23626
+ if( errno==EINTR ) continue;
23627
+ break;
23628
+ }
23629
+ if( fd>2 ) break;
23630
+ osClose(fd);
23631
+ sqlite3_log(SQLITE_WARNING,
23632
+ "attempt to open \"%s\" as file descriptor %d", z, fd);
23633
+ fd = -1;
23634
+ if( osOpen("/dev/null", f, m)<0 ) break;
23635
+ }
2365123636
 if( fd>=0 ){
2365223637
 if( m!=0 ){
2365323638
 struct stat statbuf;
2365423639
 if( osFstat(fd, &statbuf)==0
2365523640
 && statbuf.st_size==0
2365623641
--- src/sqlite3.c
+++ src/sqlite3.c
@@ -656,11 +656,11 @@
656 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
657 ** [sqlite_version()] and [sqlite_source_id()].
658 */
659 #define SQLITE_VERSION "3.8.1"
660 #define SQLITE_VERSION_NUMBER 3008001
661 #define SQLITE_SOURCE_ID "2013-08-29 23:36:49 30d38cc44904d93508b87e373b2f45d5f93e556b"
662
663 /*
664 ** CAPI3REF: Run-Time Library Version Numbers
665 ** KEYWORDS: sqlite3_version, sqlite3_sourceid
666 **
@@ -23594,35 +23594,10 @@
23594 if( aSyscall[i].pCurrent!=0 ) return aSyscall[i].zName;
23595 }
23596 return 0;
23597 }
23598
23599 /*
23600 ** If fd is a file descriptor that would be dangerous to use for an
23601 ** ordinary file, the close it, reopen it as /dev/null to get it out
23602 ** of the way, then return true.
23603 **
23604 ** If fd is safe, return 0.
23605 **
23606 ** It is dangerous to have a database file open of file descriptors 1 or
23607 ** 2 because those normally mean standard output and standard error. Other
23608 ** components of the system might write directly to those file descriptors
23609 ** and overwrite parts of the database file. Something like this happened
23610 ** on 2013-08-29 to the canonical Fossil repository when some error caused
23611 ** the database file to be opened on file descriptor 2 and later an assert()
23612 ** fired and wrote error message text into file descriptor 2, corrupting
23613 ** the repository.
23614 */
23615 static int isReservedFd(int fd, const char *z, int f, int m){
23616 if( fd<0 || fd>2 ) return 0;
23617 sqlite3_log(SQLITE_WARNING,
23618 "attempt to open \"%s\" as file descriptor %d", z, fd);
23619 osClose(fd);
23620 (void)osOpen("/dev/null",f,m);
23621 return 1;
23622 }
23623
23624 /*
23625 ** Invoke open(). Do so multiple times, until it either succeeds or
23626 ** fails for some reason other than EINTR.
23627 **
23628 ** If the file creation mode "m" is 0 then set it to the default for
@@ -23639,17 +23614,27 @@
23639 ** recover the hot journals.
23640 */
23641 static int robust_open(const char *z, int f, mode_t m){
23642 int fd;
23643 mode_t m2 = m ? m : SQLITE_DEFAULT_FILE_PERMISSIONS;
23644 do{
23645 #if defined(O_CLOEXEC)
23646 fd = osOpen(z,f|O_CLOEXEC,m2);
23647 #else
23648 fd = osOpen(z,f,m2);
23649 #endif
23650 }while( (fd<0 && errno==EINTR) || isReservedFd(fd,z,f,m2) );
 
 
 
 
 
 
 
 
 
 
23651 if( fd>=0 ){
23652 if( m!=0 ){
23653 struct stat statbuf;
23654 if( osFstat(fd, &statbuf)==0
23655 && statbuf.st_size==0
23656
--- src/sqlite3.c
+++ src/sqlite3.c
@@ -656,11 +656,11 @@
656 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
657 ** [sqlite_version()] and [sqlite_source_id()].
658 */
659 #define SQLITE_VERSION "3.8.1"
660 #define SQLITE_VERSION_NUMBER 3008001
661 #define SQLITE_SOURCE_ID "2013-08-30 06:20:23 d9c018f8155ab48df8e0e02519bba50588fe49fc"
662
663 /*
664 ** CAPI3REF: Run-Time Library Version Numbers
665 ** KEYWORDS: sqlite3_version, sqlite3_sourceid
666 **
@@ -23594,35 +23594,10 @@
23594 if( aSyscall[i].pCurrent!=0 ) return aSyscall[i].zName;
23595 }
23596 return 0;
23597 }
23598
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
23599 /*
23600 ** Invoke open(). Do so multiple times, until it either succeeds or
23601 ** fails for some reason other than EINTR.
23602 **
23603 ** If the file creation mode "m" is 0 then set it to the default for
@@ -23639,17 +23614,27 @@
23614 ** recover the hot journals.
23615 */
23616 static int robust_open(const char *z, int f, mode_t m){
23617 int fd;
23618 mode_t m2 = m ? m : SQLITE_DEFAULT_FILE_PERMISSIONS;
23619 while(1){
23620 #if defined(O_CLOEXEC)
23621 fd = osOpen(z,f|O_CLOEXEC,m2);
23622 #else
23623 fd = osOpen(z,f,m2);
23624 #endif
23625 if( fd<0 ){
23626 if( errno==EINTR ) continue;
23627 break;
23628 }
23629 if( fd>2 ) break;
23630 osClose(fd);
23631 sqlite3_log(SQLITE_WARNING,
23632 "attempt to open \"%s\" as file descriptor %d", z, fd);
23633 fd = -1;
23634 if( osOpen("/dev/null", f, m)<0 ) break;
23635 }
23636 if( fd>=0 ){
23637 if( m!=0 ){
23638 struct stat statbuf;
23639 if( osFstat(fd, &statbuf)==0
23640 && statbuf.st_size==0
23641
M src/sqlite3.h
+1 -1
--- src/sqlite3.h
+++ src/sqlite3.h
@@ -107,11 +107,11 @@
107107
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
108108
 ** [sqlite_version()] and [sqlite_source_id()].
109109
 */
110110
 #define SQLITE_VERSION "3.8.1"
111111
 #define SQLITE_VERSION_NUMBER 3008001
112
-#define SQLITE_SOURCE_ID "2013-08-29 23:36:49 30d38cc44904d93508b87e373b2f45d5f93e556b"
112
+#define SQLITE_SOURCE_ID "2013-08-30 06:20:23 d9c018f8155ab48df8e0e02519bba50588fe49fc"
113113
114114
 /*
115115
 ** CAPI3REF: Run-Time Library Version Numbers
116116
 ** KEYWORDS: sqlite3_version, sqlite3_sourceid
117117
 **
118118
--- src/sqlite3.h
+++ src/sqlite3.h
@@ -107,11 +107,11 @@
107 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
108 ** [sqlite_version()] and [sqlite_source_id()].
109 */
110 #define SQLITE_VERSION "3.8.1"
111 #define SQLITE_VERSION_NUMBER 3008001
112 #define SQLITE_SOURCE_ID "2013-08-29 23:36:49 30d38cc44904d93508b87e373b2f45d5f93e556b"
113
114 /*
115 ** CAPI3REF: Run-Time Library Version Numbers
116 ** KEYWORDS: sqlite3_version, sqlite3_sourceid
117 **
118
--- src/sqlite3.h
+++ src/sqlite3.h
@@ -107,11 +107,11 @@
107 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
108 ** [sqlite_version()] and [sqlite_source_id()].
109 */
110 #define SQLITE_VERSION "3.8.1"
111 #define SQLITE_VERSION_NUMBER 3008001
112 #define SQLITE_SOURCE_ID "2013-08-30 06:20:23 d9c018f8155ab48df8e0e02519bba50588fe49fc"
113
114 /*
115 ** CAPI3REF: Run-Time Library Version Numbers
116 ** KEYWORDS: sqlite3_version, sqlite3_sourceid
117 **
118

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button