Subject: Bug in unix.c(unix_open) (getting lock from other process)

From: Alexander Bergolth <[email-masked]>
Date: Tue, 4 May 1999 13:03:48 +0200 (MES)

Hi!

I noticed a bug in imap/src/osdep/unix/unix.c (unix_open):
While trying to lock a mailbox, lockname is called first, which also tries
to open and lock the file that contains the PID of the other process.
If it failes, this fuction closes the pid-file and returns -1, which is
assigned to fd in line 393 of unix.c.

But if lockname failes and it's the first try to obtain the lock, the
file descriptor of the already closed file is used to read the process id
which, of course, fails.

I have I have added a patch for this below.

Cheers,
         Leo

--- /usr/local/src/pine4.10/imap/src/osdep/unix/unix.c	Sat Jan 23 05:30:02 1999
+++ imap/src/osdep/unix/unix.c	Tue May  4 12:06:02 1999
@@ -393,8 +393,13 @@
     if ((fd = lockname (tmp,stream->mailbox,LOCK_EX|LOCK_NB)) < 0) {
       if (retry-- == KODRETRY) {/* no, first time through? */
 				/* yes, get other process' PID */
-	if (!fstat (fd,&sbuf) && (i = min (sbuf.st_size,MAILTMPLEN)) &&
-	    (read (fd,tmp,i) == i) && !(tmp[i] = 0) && (i = atol (tmp))) {
+	if (((fd= open(tmp, O_RDONLY, 0)) != -1) &&
+	    !fstat (fd,&sbuf) && 
+	    (i = min (sbuf.st_size,MAILTMPLEN)) &&
+	    (read (fd,tmp,i) == i) &&
+	    (close(fd) != -1) &&
+	    !(tmp[i] = 0) && 
+	    (i = atol (tmp))) {
 	  kill ((int) i,SIGUSR2);
 	  sprintf (tmp,"Trying to get mailbox lock from process %lu",i);
 	  mm_log (tmp,WARN);

-----------------------------------------------------------------------
Alexander (Leo) Bergolth                          [email-masked]
WU-Wien - Zentrum fuer Informatikdienste       http://leo.wu-wien.ac.at
Info Center
Linux - because reboots are for hardware changes

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------