Skip to content

Chore: uthash update and buffer overflow found#570

Open
Piloalucard wants to merge 4 commits intoLinearTapeFileSystem:v2.4.8-windows-supportfrom
Piloalucard:chore/uthash-and-cwe
Open

Chore: uthash update and buffer overflow found#570
Piloalucard wants to merge 4 commits intoLinearTapeFileSystem:v2.4.8-windows-supportfrom
Piloalucard:chore/uthash-and-cwe

Conversation

@Piloalucard
Copy link
Member

@Piloalucard Piloalucard commented Feb 10, 2026

Summary of changes

This pull request includes following changes or fixes.

Type of change

  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have confirmed my fix is effective or that my feature works

@Piloalucard
Copy link
Member Author

For testing, created a bash script to automatize common tests of files and directories, and different usages of ltfsck and mkltfs.

Testing script: test_ltfs_build.sh
Test passed using file-backend:
ltfs_test_log_20260209_185930.log

@vandelvan vandelvan requested a review from XV02 February 12, 2026 17:16
Copy link

@XV02 XV02 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your work, looks good, GTG!

@vandelvan vandelvan requested a review from alexzc117 February 12, 2026 17:38
Copy link

@alexzc117 alexzc117 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good for me. Thanks for your effort.

@amissael95 amissael95 self-requested a review February 13, 2026 16:51
_he_new_buckets = (UT_hash_bucket*)uthash_malloc( \
sizeof(struct UT_hash_bucket) * (tbl)->num_buckets * 2U); \
if (!_he_new_buckets) { \
HASH_RECORD_OOM(oomed); \
Copy link
Contributor

@amissael95 amissael95 Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The HASH_RECORD_OOM macro ends up expanding to exit(-1) by default, it would make the ltfs process to terminate in case of malloc returning null pointer and we are now depending on the errno set by malloc. This means that we will not longer see the 10001E message in ltfs, but it will be still stopped.

@Piloalucard
Copy link
Member Author

Test

  1. Before fix (Debug messages printed even the log level is INFO, write performance affected)
PS C:\Program Files\IBM\LTFS> .\ltfs.exe -o changer_devname=0.0.20.1 L
LTFS61259I Sync type is "time", Sync time is 300 sec
LTFS61509I Set trace level in library (LTFS_INFO)
LTFS61206I LTFS starting. Drive:L, (Dec  9 2025 12:41:16) log level 2
LTFS17085I Plugin: Loading "scsilib" tape backend.
LTFS17085I Plugin: Loading "unified" iosched backend.
LTFS17085I Plugin: Loading "scsilib" changer backend.
LTFS17085I Plugin: Loading "memory" crepos backend.
LTFS11593I LTFS starts with a ILAN license version 2.4.8.2.
LTFS62611I Opening a device through scsilib driver (2ed5e5c0h).
LTFS62553D scsilib: scsiExecCDB(12h):.
LTFS62554D scsilib: scsiExecCDB(12h): rc=0 SysErr=0 SCSIStatus=00h sense=00h/0000h:32.
LTFS62553D scsilib: scsiExecCDB(12h):.
LTFS62554D scsilib: scsiExecCDB(12h): rc=0 SysErr=0 SCSIStatus=00h sense=00h/0000h:32.
LTFS62612D scsi0:0.20.1 is opened.
LTFS62613I Changer serial is 55L3A78014R3LL01.
  1. After fix (No debug messages because of level, no write performance issues)
PS C:\Program Files\ibm\LTFS> .\ltfs.exe -o changer_devname=5.0.0.1 L
LTFS61259I Sync type is "time", Sync time is 300 sec
LTFS61509I Set trace level in library (LTFS_INFO)
LTFS61206I LTFS starting. Drive:L, (Feb  6 2026 14:53:36) log level 2
LTFS17085I Plugin: Loading "scsilib" tape backend.
LTFS17085I Plugin: Loading "unified" iosched backend.
LTFS17085I Plugin: Loading "scsilib" changer backend.
LTFS17085I Plugin: Loading "memory" crepos backend.
LTFS11593I LTFS starts with a ILAN license version 2.4.8.
LTFS62611I Opening a device through scsilib driver (67e37370h).
LTFS62613I Changer serial is 55L3A78014R3LL02.
LTFS62160I Drive serial is 117193D065.
LTFS17160I Maximum device block size is 524288.
LTFS61509I Set trace level in library (LTFS_INFO)
LTFS11545I Rebuilding the cartridge inventory.
LTFS11627I Getting Inventory - 55L3A78014R3LL02.
LTFS11629I Aqcuireing MoveLock - 55L3A78014R3LL02.
LTFS11630I Aqcuired Move Lock (3) - 55L3A78014R3LL02.
LTFS11628I Got Inventory - 55L3A78014R3LL02.
LTFS11637I Reset the cartridge link against the drive 117193D065.
LTFS11571I State of tape 'FC0541L8' in slot 0x1 is changed from 'INIT' to 'NOT_MOUNTED_YET'.
LTFS11635I Link the drive 117193D065 to the cartridge FC0541L8.
LTFS11571I State of tape 'CLN156L1' in slot 0x3ea is changed from 'INIT' to 'NON_SUPPORTED_TAPE'.
LTFS11720I Built the cartridge inventory (0).
LTFS11774I Starting volume cache cleaning.
LTFS11775I Volume cache cleaning is finished
LTFS10005E Null argument (priv) to dcache_get_workdir.
LTFS11776I Starting volume cache load.
LTFS11777I Loaded required volume caches.
LTFS14708I LTFS admin server version 2 is starting on port 7600.
LTFS61280I Symbolic link type is (posix)
LTFS61237I Read-only directory mode is Windows

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants