SQLUM Thread Safety Bug

  • 23 May 2005
  • 1 reply
  • 0 views

Badge +3
Hi, 8)

The sqlum code in file k2usermanager.vb
uses a "Private arrUserNames As New ArrayList".

This is not thread safe and as the number of exported destination queues increase so does the chance of a threads overwriting each others variables. I noticed this in early tests when using the SQLUM.

Example:
The "Public Function ResolveQueue" is being called by the server periodically in a threaded manner. BUT Because arrUserNames is not thread safe 2 different calls can corrupt each others queue resolution. I.e. the destination queues WILL and DO resolve sometimes incorrectly.
After we have exceeded 30 destination queues (say 5 processes with 6 queues in each) it was happening all the time. Before that it was happening only rarely and was impossible to track the bug.

Remedy. I have fixed this problem by sending the arrUserNames variable in the function header as input variables in k2usermanager.vb and removed the private class variable arrUserNames in the top of the file.

Note that this problem is not exclusive to destination queues.

If you are using SQLUM I strongly recommend you to fix it before you use it in a production environment.

Regards,
Gabor Barla-Szabo :P
Fourier Approach
fourier.co.za

1 reply

Badge +9
The K2.net 2003 SQL User Manager is an open source user manager (using a SQL Server Database) as an alternative to Active Directory. The K2.net 2003 SQL User Manager was designed as a sample for developers, demonstrating the extensibility around K2.net 2003 with custom templates. The source code is provided (as part of the installation), allowing developers to customize and tailor the components to meet specific business requirements. This includes using the SQL User Manager as a template in order to build a user manager for any 3rd party security provider. When uninstalled, K2.net 2003 will revert to use Active Directory as a user manager.

Please Note: The K2.net 2003 SQL User Manager is not supported by the K2.net Support Team. It is therefore recommended that the components are tested prior to implementation as part of a production environment.

License: Open Source

Reply