Uploaded image for project: 'ROOT'
  1. ROOT
  2. ROOT-6240

Bug allows write-protecting ROOT files

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: High
    • Resolution: Fixed
    • Affects Version/s: 5.34/00
    • Fix Version/s: None
    • Component/s: I/O
    • Labels:
      None
    • Environment:

      all

      Description

      Write-protecting ROOT files; feature or bug?

      If I manually change the NBytesFree in the ROOT file header to -1, the following happens. First, in void TFile::Init(Bool_t create):

      //------------Read Free segments structure if file is writable
      if (fWritable) {
      fFree = new TList;
      if (fSeekFree > fBEGIN) {
      ReadFree();

      This calls void TFile::ReadFree(), which does:

      TKey *headerfree = new TKey(fSeekFree, fNbytesFree, this);

      which allocates a buffer, like: new char [fNbytesFree]

      The value of fNbytesFree is never checked. If I change a ROOT file-header to have -1 for fNbytesFree (because it's a signed integer), ROOT tries to allocate several terabytes of memory (in other words, it crashes hard: bad alloc). However, since this code only executes if fWritable==true, this only happens if the file gets opened in a write-able mode ("UPDATE" for example). So opening the file read-only works perfectly, but ROOT crashes when trying to open the file with writing enabled. This basically creates a write-protection on the file.

      (Code to produce a "write-protected" ROOT file attached.)

        Attachments

          Activity

            People

            • Assignee:
              pcanal Philippe Canal
              Reporter:
              dgeerts Daniel Geerts
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: