[rrdtool-maint] Bug#960733: rrdtool update with invalid DS format corrupts rrd file

[Joey Hess]

Package: rrdtool
Version: 1.7.2-3+b4
Severity: normal

joey at darkstar:~> rrdtool create foo.rrd DS:foo:GAUGE:1:10:1000 RRA:AVERAGE:0.5:1:864000
joey at darkstar:~> rrdtool update foo.rrd N:100
joey at darkstar:~> rrdtool tune foo.rrd DS:xxx
ERROR: invalid DS format
- exit 1

That tune looks like it would have failed to do anything, but in fact
it's added a weird DS to the file.

So now updates will fail:

joey at darkstar:~> rrdtool update foo.rrd N:100
ERROR: foo.rrd: expected 2 data source readings (got 1) from N
- exit 1
joey at darkstar:~> rrdtool update foo.rrd N:100:1
ERROR: unknown data acquisition function '0'

rrdtool dump shows that it added a DS with an empty name and bogus type.

        <ds>
                <name>   </name>
                <type> 0 </type>
                <minimal_heartbeat>0</minimal_heartbeat>
                <min>0.0002525175e-308</min>
                <max>0.0001931016e-308</max>

                <!-- PDP Status -->
                <last_ds>1</last_ds>
                <value>0.0000000000e+00</value>
                <unknown_sec> 194 </unknown_sec>
        </ds>

The empty name also makes it hard to delete it, because "DEL:" will not
refer to it. The only way I found to recover my data was to edit the xml
dump, putting in a name, and then load and delete it.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.5.0-2-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_USER, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages rrdtool depends on:
ii  libc6         2.30-4
ii  libglib2.0-0  2.64.2-1
ii  librrd8       1.7.2-3+b4

rrdtool recommends no packages.

Versions of packages rrdtool suggests:
pn  librrds-perl  <none>

-- no debconf information

-- 
see shy jo