[Sedna-discussion] [ sedna-Bugs-2859043 ] Some name crushed sedna in Uri::check_constraints

[SourceForge.net <no...@so...>]

Bugs item #2859043, was opened at 2009-09-15 06:55
Message generated for change (Comment added) made by shcheklein
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=713730&aid=2859043&group_id=129076

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
>Category: Query Execution
>Group: Sedna (current)
>Status: Closed
>Resolution: Fixed
Priority: 9
Private: No
Submitted By: Stas7Sint (stas7sint)
>Assigned to: Ilya Taranov (mozinsur)
Summary: Some name crushed sedna in Uri::check_constraints

Initial Comment:
Sedna 3.2.64 for linux i686.
OS Ubuntu 9.04.
When I create or load document with name beddcaba-ccc3-4e9d-9fb6-00c911d81357 in any collection or root, sedna fall down after "Uri::check_constraints" in xs_uri.cpp but before "if (!valid) throw ..." in metadata.cpp
When I change metod "Uri::check_constraints" on:
*valid = true;
if(nfo != NULL){/*
OLD CODE
*/}
queries CREATE DOCUMENT 'beddcaba-ccc3-4e9d-9fb6-00c911d81357', and doc('beddcaba-ccc3-4e9d-9fb6-00c911d81357') work fine.

----------------------------------------------------------------------

>Comment By: Ivan Shcheklein (shcheklein)
Date: 2009-09-16 19:28

Message:
Thank you for the detailed bug report! We've fixed this issue. Please check
out the latest development build which you can find here:
http://modis.ispras.ru/FTPContent/sedna/development/ .

----------------------------------------------------------------------

Comment By: Stas7Sint (stas7sint)
Date: 2009-09-15 09:13

Message:
In sedna 3.2.78 file xs_uri.cpp is same as in sedna 3.2.64.

----------------------------------------------------------------------

Comment By: Stas7Sint (stas7sint)
Date: 2009-09-15 09:00

Message:
Also, when I change string:
if(counter <= MAX_SCHEME_NAME_SIZE) scheme_buf[counter++] =
TO_LOWER_CASE(value);
to string:
if(counter < MAX_SCHEME_NAME_SIZE) scheme_buf[counter++] =
TO_LOWER_CASE(value);
in  method "is_URI_with_scheme_and_normalized"  in xs_uri.cpp, all work
fine.
In originally possible buffer overflow with names length more thah 10 in
string:
scheme_buf[counter] = '\0';

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=713730&aid=2859043&group_id=129076