Skip to content
  • Mauritz Sundell's avatar
    860ba1a4
    Bug#29024275 BUFFER OVERWRITE WHEN SENDING BIG LONG SIGNALS · 860ba1a4
    Mauritz Sundell authored
    
    
    Problem
    =======
    
    In Ndb nodes the transporter layer limits the message size to 32'768
    bytes.  When sending messages send buffers also put limitations on
    message size.  When a message is appended into a send buffer page checks
    are done to ensure that message will fit.
    
    If not, a new page is used, but no checks are done that message actually
    will fit in an empty page, this cause a buffer overwrite and next page in
    memory will be overwritten.
    
    For data nodes the biggest message supported by send buffer
    (thr_send_page) is 32'756 bytes.  And for api and mgmd node the biggest
    message supported by send buffer (TFPage) is 32'752 bytes.
    
    Note that signals sent within a data node do not use send buffers (or
    transporter) and do not suffer from these limitations.
    
    Solution
    ========
    
    The callback function getWritePtr that is used by transporter layer to
    get buffer memory for a message could return a null pointer when all
    buffer memory was in use.  Now returning a null pointer can be used also
    to indicate that message is too big, this is communicated using a new
    parameter pointing to a SendStatus variable, set to SEND_BUFFER_FULL or
    SEND_MESSAGE_TOO_BIG depending on the condition.  This error is then
    returned by prepareSend and upper layer will handle SEND_MESSAGE_TOO_BIG
    as before.
    
    The size of TFPage was always 32'768 bytes, and size of page was stored
    in the page itseld.  This was changed to static property to be able to
    check if message would fit in a TFPage without need to actually have a
    page.
    
    Reviewed-by: default avatarOle John Aske <ole.john.aske@oracle.com>
    860ba1a4
    Bug#29024275 BUFFER OVERWRITE WHEN SENDING BIG LONG SIGNALS
    Mauritz Sundell authored
    
    
    Problem
    =======
    
    In Ndb nodes the transporter layer limits the message size to 32'768
    bytes.  When sending messages send buffers also put limitations on
    message size.  When a message is appended into a send buffer page checks
    are done to ensure that message will fit.
    
    If not, a new page is used, but no checks are done that message actually
    will fit in an empty page, this cause a buffer overwrite and next page in
    memory will be overwritten.
    
    For data nodes the biggest message supported by send buffer
    (thr_send_page) is 32'756 bytes.  And for api and mgmd node the biggest
    message supported by send buffer (TFPage) is 32'752 bytes.
    
    Note that signals sent within a data node do not use send buffers (or
    transporter) and do not suffer from these limitations.
    
    Solution
    ========
    
    The callback function getWritePtr that is used by transporter layer to
    get buffer memory for a message could return a null pointer when all
    buffer memory was in use.  Now returning a null pointer can be used also
    to indicate that message is too big, this is communicated using a new
    parameter pointing to a SendStatus variable, set to SEND_BUFFER_FULL or
    SEND_MESSAGE_TOO_BIG depending on the condition.  This error is then
    returned by prepareSend and upper layer will handle SEND_MESSAGE_TOO_BIG
    as before.
    
    The size of TFPage was always 32'768 bytes, and size of page was stored
    in the page itseld.  This was changed to static property to be able to
    check if message would fit in a TFPage without need to actually have a
    page.
    
    Reviewed-by: default avatarOle John Aske <ole.john.aske@oracle.com>
Loading