[open-cobol-list] Bug with COB_SYNC and Berkley DB indexed file CLOSE

[Linton Miller]

While migrating an application from Microfocus to GnuCOBOL 2.0, I came across a 
bug when closing indexed files stored using Berkley DB, and COB_SYNC being 
true. When performing the CLOSE, the program core dumps with a SIGSEGV. I'm 
working from the gnu-cobol-2.0 SVN branch (r609), on Red Hat Linux 64bit.

Building the library with debugging gives details in the core dump stacktrace:

#0  0x00007f9ba4f70713 in cob_sync (f=0x112cde0) at fileio.c:657
#1  0x00007f9ba4f708b1 in save_status (f=0x112cde0, fnstatus=0x0, status=0)
    at fileio.c:714
#2  0x00007f9ba4f777b4 in cob_close (f=0x112cde0, fnstatus=0x0, opt=0,
    remfil=0) at fileio.c:4580
#3  0x00007f9ba4f7b93d in cob_exit_fileio () at fileio.c:6314
#4  0x00007f9ba4f5d5fe in cob_terminate_routines () at common.c:319
#5  0x00007f9ba4f5d859 in cob_sig_handler (sig=11) at common.c:432
#6  <signal handler called>
#7  0x00007f9ba4f70713 in cob_sync (f=0x112cc00) at fileio.c:657
#8  0x00007f9ba4f708b1 in save_status (f=0x112cc00, fnstatus=0x7f9b9ea218c0,
    status=0) at fileio.c:714
#9  0x00007f9ba4f777b4 in cob_close (f=0x112cc00, fnstatus=0x7f9b9ea218c0,
    opt=0, remfil=0) at fileio.c:4580

The problem is obvious enough: indexed_close is called, which closes the DB and 
frees the indexed_file structure in f->file, but that is then followed by 
save_status, where it tries to sync because COB_SYNC=Y and dereferences the 
f->file structure, causing the core dump.

That can be fixed by a simple "is open" test in either save_status or cob_sync. 
It also seems good style to NULL out the f->file pointer after closing the DB, 
rather than leaving a pointer to freed memory dangling.

I applied the following patch, which corrects the problem for us:

--- libcob/fileio.c     (revision 609)
+++ libcob/fileio.c     (working copy)
@@ -651,11 +651,13 @@
        if (f->organization == COB_ORG_INDEXED) {  #ifdef WITH_DB
                p = f->file;
-               for (i = 0; i < f->nkeys; ++i) {
-                       if (p->db[i]) {
-                               DB_SYNC (p->db[i]);
+               if (p) {
+                       for (i = 0; i < f->nkeys; ++i) {
+                               if (p->db[i]) {
+                                       DB_SYNC (p->db[i]);
+                               }
+                       }
                }
#elif  defined(WITH_ANY_ISAM)
                fh = f->file;
                if (fh) {
@@ -3283,6 +3285,9 @@
        COB_UNUSED (opt);

        p = f->file;
+       if (p == NULL) {
+               return COB_STATUS_00_SUCCESS;
+       }
        /* Close DB's */
        for (i = 0; i < (int)f->nkeys; ++i) {
                if (p->cursor[i]) {
@@ -3313,6 +3318,7 @@
                bdb_env->lock_id_free (bdb_env, p->bdb_lock_id);
        }
        cob_free (p);
+       f->file = NULL;

        return COB_STATUS_00_SUCCESS;


And I'd just like to express our thanks for the wonderful effort that is 
GnuCOBOL. Keep up the good work!

Linton

-----
Linton Miller
Registration and Titling Solutions
Dealertrack Technologies
p 860-448-3177
www.dealertrack.com