search

jorabin / KeePassJava2

Java API for KeePass Password Databases - Read/Write 2.x (File versions 3 and 4), Read 1.x
Apache License 2.0
251 stars 70 forks source link

Loading database failed: race condition in HashedBlockInputStream #29

Closed danielgrahl closed 2 years ago

danielgrahl commented 3 years ago

Loading a database may fail when accessed by multiple threads. The reason seems to be that in HashedBlockInputStream, there is unsynchronized access to the static field md5. BTW: This is misnamed since it computes SHA256, not MD5.

Stacktrace:

MD5 check failed while reading HashBlock
 at org.linguafranca.pwdb.hashedblock.HashedBlockInputStream.load(HashedBlockInputStream.java:170)
 at org.linguafranca.pwdb.hashedblock.HashedBlockInputStream.get(HashedBlockInputStream.java:122)
 at org.linguafranca.pwdb.hashedblock.HashedBlockInputStream.read(HashedBlockInputStream.java:89)
 at java.util.zip.InflaterInputStream.fill(InflaterInputStream.java:238)
 at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:158)
 at java.util.zip.GZIPInputStream.read(GZIPInputStream.java:117)
 at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:122)
 at org.apache.xerces.impl.XMLEntityManager$RewindableInputStream.readAndBuffer(XMLEntityManager.java:3116)
 at org.apache.xerces.impl.XMLEntityManager.setupCurrentEntity(XMLEntityManager.java:1018)
 at org.apache.xerces.impl.XMLVersionDetector.determineDocVersion(XMLVersionDetector.java:144)
 at org.apache.xerces.parsers.XML11Configuration.parse(XML11Configuration.java:832)
 at org.apache.xerces.parsers.XML11Configuration.parse(XML11Configuration.java:798)
 at org.apache.xerces.parsers.XMLParser.parse(XMLParser.java:108)
 at org.apache.xerces.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1198)
 at org.apache.xerces.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:564)
 at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:258)
 at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:229)
 at javax.xml.bind.helpers.AbstractUnmarshallerImpl.unmarshal(AbstractUnmarshallerImpl.java:136)
 at javax.xml.bind.helpers.AbstractUnmarshallerImpl.unmarshal(AbstractUnmarshallerImpl.java:183)
 at org.linguafranca.pwdb.kdbx.jaxb.JaxbSerializableDatabase.load(JaxbSerializableDatabase.java:77)
 at org.linguafranca.pwdb.kdbx.jaxb.JaxbSerializableDatabase.load(JaxbSerializableDatabase.java:41)
 at org.linguafranca.pwdb.kdbx.stream_3_1.KdbxStreamFormat.load(KdbxStreamFormat.java:39)
 at org.linguafranca.pwdb.kdbx.jaxb.JaxbDatabase.load(JaxbDatabase.java:71)
 at org.linguafranca.pwdb.kdbx.jaxb.JaxbDatabase.load(JaxbDatabase.java:64)
jorabin commented 3 years ago

Thanks - noted.