[asterisk-bugs] [Asterisk 0014682]: [patch] Race condition in ast_db_get()

Tue Mar 17 00:54:08 CDT 2009

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=14682 
====================================================================== 
Reported By:                makoto
Assigned To:                tilghman
====================================================================== 
Project:                    Asterisk
Issue ID:                   14682
Category:                   Core/General
Reproducibility:            sometimes
Severity:                   minor
Priority:                   normal
Status:                     closed
Asterisk Version:           1.2.X 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             2009-03-16 20:07 CDT
Last Modified:              2009-03-17 00:54 CDT
====================================================================== 
Summary:                    [patch] Race condition in ast_db_get()
Description: 
ast_db_get() may retrieve a wrong value because the data are copied
to the variable value after dblock is unlocked.
The copy should be done before unlock.

This can be reproduced on our cutomer's environment which is based on
Asterisk 1.2.18. I don't test it on the 1.4.x yet, but I believe that
this can be reproduced also on Asterisk 1.4 or later.

Attached patch will fix the problem.

====================================================================== 

---------------------------------------------------------------------- 
 (0101843) svnbot (reporter) - 2009-03-17 00:54
 http://bugs.digium.com/view.php?id=14682#c101843 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 182452

_U  branches/1.6.1/
U   branches/1.6.1/main/db.c

------------------------------------------------------------------------
r182452 | tilghman | 2009-03-17 00:54:08 -0500 (Tue, 17 Mar 2009) | 21
lines

Merged revisions 182450 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
  r182450 | tilghman | 2009-03-17 00:51:54 -0500 (Tue, 17 Mar 2009) | 14
lines

  Merged revisions 182449 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4

  ........
    r182449 | tilghman | 2009-03-17 00:50:52 -0500 (Tue, 17 Mar 2009) | 7
lines

    Fix race in astdb
    The underlying db1 implementation does not fully isolate the pages
retrieved
    from astdb, so the lock protecting accesses needs to be extended until
the
    copy from the shared memory structure is done.
    (closes issue http://bugs.digium.com/view.php?id=14682)
     Reported by: makoto
  ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=182452 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-03-17 00:54 svnbot         Checkin                                      
2009-03-17 00:54 svnbot         Note Added: 0101843                          
======================================================================