Icon View Incident Report

Serious Serious
Reported By: Michael Baytalsky
Reported On: 6/1/2002
For: Version 3.10 Build 1
# 1132 Internal Handling of Virtual File Handles for File I/O Using Improper Allocation Method

I came acrooss a few lines of code in the server, that doesn't seem right to me. See my comments below.

====================
function TAbstractFile.CreateNew: Integer;
var
   NewFileHandle: pFileHandleRecord;
begin
   LockFileSection;
   try
      Inc(FUseCount);
      NewFileHandle:=AllocMem(SizeOf(TFileHandleRecord));
      FHandles.Add(NewFileHandle);
      with NewFileHandle^ do
         begin
         Handle:=FHandles.Count; // MB: If one or more records were deleted
// from FHandles, then we there's a chance that we'll get duplicated 
values in Handle. // See below...
         FilePos:=0;
         end;
      FFileSize:=0;
      Result:=NewFileHandle^.Handle;
   finally
      UnlockFileSection;
   end;
end;

procedure TAbstractFile.Close(FileHandle: Integer);
var
   HandlePos: Integer;
   TempPtr: Pointer;
begin
   LockFileSection;
   try
      HandlePos:=GetHandlePos(FileHandle);  // MB: You get a record by 
Handle.
// If you have duplicates there then you will get a *wrong* record.
      if (HandlePos <> -1) then
         begin
         TempPtr:=FHandles[HandlePos];
         DeAllocMem(TempPtr);
         FHandles.Delete(HandlePos);   // MB: We do delete from this list, so 
we will have duplicates!!!
         Dec(FUseCount);
         end;
   finally
      UnlockFileSection;
   end;
end;

====================
This is defenetely related most to the memory tables. I wasn't unable to produce SQL, that would cause engine to throw any errors, but the scenario should be like this:

sql1: select * from memory t1;  // Handle = 1

sql2: select * from memory t1;  // Handle = 2
close sql1

sql3: select * from memory t1;  // Handle = 2 - duplicate access sql 2 & 3
simultaneously somehow.

To fix this, just change Handle:=FHandles.Count; to something like 
Inc(FHandleCounter);
Handle:=FHandleCounter;

where FHandleCounter is a field of TAbstractFile.




Resolution Resolution
Fixed Problem on 6/1/2002 in version 3.11 build 1
Image