View Issue Details

IDProjectCategoryView StatusLast Update
0006146Talerexchangepublic2021-09-02 16:14
Reporterfefe Assigned ToChristian Grothoff Resolution deadline
ImplementerReviewer 
Release signed byDeployed by 
VerifierCommunicator 
Data protection authority notification requiredNo  
CSIRT notification requiredNo  
Estimated effort (hours)Actual effort (hours)0 
Fast-trackNo
Work packagenone
PrioritynormalSeverityminorReproducibilityN/A
Status closedResolutionfixed 
Product Version0.7.0 
Target Version0.7.1Fixed in Version0.7.1 
Summary0006146: Taler exchange is multithreaded yet uses GNUNET_STRINGS_absolute_time_to_string
DescriptionGNUNET_STRINGS_absolute_time_to_string is not thread-safe. It returns a pointer to a static buffer, which is the same for all callers.
So if two threads call it simultaneously, the two callers will clobber each other's output into the buffer and return a garbled value.

Recommendation: add a GNUNET_STRINGS_absolute_time_to_string_r function that additionally takes a buffer and a buffer size as arguments.
Steps To Reproducegnunet-0.12.2/src/util/strings.c

 741 const char *
 742 GNUNET_STRINGS_absolute_time_to_string (struct GNUNET_TIME_Absolute t)
 743 {
 744 static char buf[255];

 759 return buf;
 760 }
TagsNo tags attached.

Required notifications

Address or linkRemarkAdded byNotifiedActions

Activities

Christian Grothoff

2020-04-02 09:40

manager   ~0015489

Fixed in a4653a7a0..225ddf0a2 (gnunet.git) and d1bf2692..340ac361 (exchange.git) by adding missing GNUNET_THREAD_LOCAL for routines with such static buffers.

Christian Grothoff

2021-09-02 16:14

manager   ~0018269

Fix committed to master branch.

Issue History

Date ModifiedUsernameFieldChange
2020-04-02 09:27fefeNew Issue
2020-04-02 09:27fefeStatusnew => assigned
2020-04-02 09:27fefeAssigned To => Christian Grothoff
2020-04-02 09:40Christian GrothoffNote Added: 0015489
2020-04-02 09:40Christian GrothoffStatusassigned => informing
2020-04-02 09:40Christian GrothoffResolutionopen => fixed
2020-04-02 09:40Christian GrothoffFixed in Version => 0.7.1
2020-04-02 09:40Christian GrothoffTarget Version => 0.7.1
2021-08-24 14:23Christian GrothoffStatusinforming => closed
2021-09-02 16:13Christian Grothoff
2021-09-02 16:14Christian GrothoffNote Added: 0018269