DataReel 6.1 Release Notes, 10/25/2026
DataReel version 6.1 (was 6.0)
DataReel Copyright (c) 2001-2026 DataReel Software Development

DataReel 6.1 is a security fix release. It fixes memory safety bugs
found by a security review of the Encrypted Password Database, which
uses the DataReel database engine. Every change in the source is
marked with a "10/25/2026" comment.

The library version in version.txt is 6.1 and the shared library
version (SHAREDLIB_VERSION in env/linux.env) is 6.1, so the Linux
shared library is built as libdatareel.so.6.1. There are no interface
changes from 6.0. Programs must be recompiled and relinked.

SECURITY FIXES
--------------
- gxBtree::ReadNode() read key_size * key_count bytes into the fixed
  key_entries buffer of a node, using the key count stored in the
  index file. A count larger than the node can hold overflowed the
  heap. Node key counts below 0 or above the node capacity are now
  rejected with gxDBASE_BADBLOCK_ERROR.
- gxBtree::InitBtree() used the key size and node order stored in an
  existing index file without checking them. A stored key size that
  does not match the key type of the tree, or a node order out of
  range, is now rejected with gxDBASE_BAD_HEADER.
- InfoHog::Read() trusted the member count and member lengths stored
  in the data file. A member count of 0 or above InfoHogMaxMembers,
  member lengths larger than the file, and a key member (member 0)
  whose length is not sizeof(TYPE) are now rejected. Callers cast
  member 0 to TYPE, so a short key member was read past its buffer.
- InfoHog::GetMember(), GetMemberLen() and SetMember() checked
  index > num_members instead of index >= num_members, and accessed
  one element past the member array.

HOW THE CHANGES WERE TESTED
---------------------------
- Index files with a root node key count of 5000 and with a wrong key
  size in the B-tree header, which crashed programs built with 6.0
  (heap corruption abort and segmentation fault), are rejected with an
  error by programs built with 6.1.
- Unchanged database and index files read the same as with 6.0.

SUPPORTED PLATFORMS
-------------------
- Linux: Red Hat Enterprise Linux 10 (the default build platform),
  RHEL 9 and RHEL 8. RHEL 6 and 7 are no longer supported. Linux builds
  use the operating system's OpenSSL.
- Windows: Windows 11 and Windows Server 2022 and 2025, with Visual
  Studio 2022 or 2026. Older Windows releases are no longer supported.
  The Windows build is 64-bit by default; 32-bit builds are kept for
  legacy code only. Windows OpenSSL builds (USESSL=1) must use only an
  OpenSSL 3.5.x LTS release, see README_windows_openssl.txt. The
  default Windows SSL build uses the native Schannel API.
- The readmes, makefile and ENV file comments and the HTML
  documentation set were updated to match. docs/README_windows_setup.html
  was regenerated from README_windows_setup.txt.
- A stray prebuilt shared library binary was removed from the
  source tree.

DataReel Copyright (c) 2001-2026 DataReel Software Development
