#6 vlcurjump crashes (on bad record)

[Derek Snider]

I've encountered a situation whereby vlcurjump() causes a segmentation fault rather than gracefully reporting that the input file is damaged (which I am assuming is the case), although the particular record in question gets displayed no problem if vlcurnext() is used to traverse the database.

Unfortunately I am not certain how this file came to be in a "bad" state.

Here is the source code which crashes, and attached as an upload is the qdbm database file which is required for the crash to occur:

#include <iostream>
#include <xvilla.h>

using namespace std;
using namespace qdbm;

int main()
{
unsigned int uid = 7653;
char *val;
Villa *villa;

try
{
villa = new Villa("header.db", Villa::OREADER, Villa::cmpint);
}
catch (Villa_error e)
{
cerr << "Error (" << e.message() << ") while opening database" << endl;
return 0;
}

try
{
cout << "jumping to uid " << uid << endl;
if ( villa->curjump((char *)&uid, sizeof(uid)) )
{
if ( (val=villa->curval()) )
{
cout << "Value: " << val << endl;
free(val);
}
else
cout << "No value" << endl;
}
}
catch (Villa_error e)
{
cerr << "Error (" << e.message() << ") while getting header.db entry for " << uid << endl;
}
return 0;
}

[Derek Snider]

potentially damaged qdbm file

[Derek Snider]

source code for testing

[Derek Snider]

Logged In: YES
user_id=793132
Originator: YES

File Added: test.cpp

[Derek Snider]

Logged In: YES
user_id=793132
Originator: YES

Oh, in case you are unable to reproduce the crash directly using the test.cpp sample code, I did have to make two small changes in villa.c where a free was occurring on a null pointer.

I changed line 2159 and 2471 from:
free(buf);

to read:
if (buf) free(buf);