Re: CVS bug - invalid change text

[Larry Jones]

address@hidden writes:
> 
> I was not complaining about wrong text in the sources checked out or in the
> repository
> (this might be caused indeed by network problems),
> but I was complaining about the internal integrity of the CVS repository.
> The internal syntax/structure of the repository is maintained by the CVS
> server,
> and it got corrupted by the CVS server (see below).

No, it didn't.

> This is definitely a flaw in the CVS server.

No, it isn't.

> The problem was caused by following change requests in the repository
> (roughly translated)
> 
> - delete 43 lines
> - insert some "corrupted" text (which did consist of one very long line
> instead of 43 individual lines).
> 
> I do not know how this text to be inserted got corrupt (could perhaps be a
> network problem).
> But that is not the problem.
> The problem is that CVS seems to enter the change requests into the
> repository whithout verifying
> that they "make sense".

CVS almost certainly did not enter that change request in that form. 
The number of lines is computed from the number of newline characters in
the change text, so there were 43 lines there when CVS wrote the
repository file.  Either the filesystem did not correctly write the
data, or some outside agent changed it afterwards.  Was the "corrupted"
text at all recognizable?  Was it all NULs?  Was it a multiple of 512
bytes in length?

> Summary: CVS does not verify whether the change request inserted "makes
> sense".
> Hence "invalid" change requests can corrupt the repository.

Wrong; CVS only writes valid change requests.  Any corruption is almost
certainly caused by some outside agent.

> Another danger of CVS is that such problems might come into the repository
> unnoticed.

This is a problem.  SCCS has a checksum in each file, but RCS does not
and the RCS file format does not lend itself to adding one.  And many
CVS commands don't read the entire file and so wouldn't be able to
verify the checksum anyway.

> Additionally CVS should report the line number/section/revision number
> where the
> invalid syntax is detected, and it should display a short reason message.

Feel free to submit patches.

-Larry Jones

Everybody's a slave to routine. -- Calvin