Bug#824067: libdbi-drivers: Memory issue causing segmentation faults in reverse dependencies

[Ruben Undheim]

Source: libdbi-drivers
Version: 0.9.0-3
Severity: important
Tags: patch

Dear Maintainer,


I've identified a problem in libdbd-sqlite3 which causes segfaults in for
instance the test suite of OpenBSC.

See #818567


The following patch fixes it:


Index: libdbi-drivers/drivers/sqlite3/dbd_sqlite3.c
===================================================================
--- libdbi-drivers.orig/drivers/sqlite3/dbd_sqlite3.c   2016-05-11 
21:13:28.927363294 +0200
+++ libdbi-drivers/drivers/sqlite3/dbd_sqlite3.c        2016-05-11 
21:14:13.412832180 +0200
@@ -1451,15 +1451,15 @@
                    break;
                  }
 
-                 word_lower[item-start+1];
-                 strncpy(word_lower,start,item-start);
-                 word_lower[item-start] = '\0';
+                 char word_lower2[item-start+1];
+                 strncpy(word_lower2,start,item-start);
+                 word_lower2[item-start] = '\0';
                  int i = 0;
-                 while (word_lower[i]) {
-                   word_lower[i] = tolower(word_lower[i]);
+                 while (word_lower2[i]) {
+                   word_lower2[i] = tolower(word_lower2[i]);
                    i++;
                  }
-                 if ( strcmp("join",word_lower) == 0 ) {
+                 if ( strcmp("join",word_lower2) == 0 ) {
                    //printf("stop skip after join found\n");
                    // we have found the next join, stop skipping
                    join_flag = 1;
@@ -1467,7 +1467,7 @@
                    break;
                  }
                   for ( i = 0 ; i < (sizeof(endwords)/sizeof *(endwords)) ; 
i++ ) {
-                     if ( strcmp(endwords[i],word_lower) == 0 ) {
+                     if ( strcmp(endwords[i],word_lower2) == 0 ) {
                         /* printf("end word!\n"); */
                         return index;



I've also reported this bug upstream, and maybe they will come up with a more
beautiful patch.



Regards
Ruben