DataReel 6.1 Release Notes

DataReel 6.1 Release Notes, 10/25/2026

DataReel 6.1 is a security fix release. It fixes memory safety bugs found by a security review of the Encrypted Password Database, which uses the DataReel database engine. Every change in the source is marked with a "10/25/2026" comment.

The library version in version.txt is 6.1 and the shared library version (SHAREDLIB_VERSION in env/linux.env) is 6.1, so the Linux shared library is built as libdatareel.so.6.1. There are no interface changes from 6.0. Programs must be recompiled and relinked.

Security Fixes

gxBtree::ReadNode() read key_size * key_count bytes into the fixed key_entries buffer of a node, using the key count stored in the index file. A count larger than the node can hold overflowed the heap. Node key counts below 0 or above the node capacity are now rejected with gxDBASE_BADBLOCK_ERROR.
gxBtree::InitBtree() used the key size and node order stored in an existing index file without checking them. A stored key size that does not match the key type of the tree, or a node order out of range, is now rejected with gxDBASE_BAD_HEADER.
InfoHog::Read() trusted the member count and member lengths stored in the data file. A member count of 0 or above InfoHogMaxMembers, member lengths larger than the file, and a key member (member 0) whose length is not sizeof(TYPE) are now rejected. Callers cast member 0 to TYPE, so a short key member was read past its buffer.
InfoHog::GetMember(), GetMemberLen() and SetMember() checked index > num_members instead of index >= num_members, and accessed one element past the member array.

How The Changes Were Tested

Index files with a root node key count of 5000 and with a wrong key size in the B-tree header, which crashed programs built with 6.0 (heap corruption abort and segmentation fault), are rejected with an error by programs built with 6.1.
Unchanged database and index files read the same as with 6.0.

Supported Platforms

Linux: Red Hat Enterprise Linux 10 (the default build platform), RHEL 9 and RHEL 8. RHEL 6 and 7 are no longer supported. Linux builds use the operating system's OpenSSL.
Windows: Windows 11 and Windows Server 2022 and 2025, with Visual Studio 2022 or 2026. Older Windows releases are no longer supported. The Windows build is 64-bit by default; 32-bit builds are kept for legacy code only. Windows OpenSSL builds (USESSL=1) must use only an OpenSSL 3.5.x LTS release, see README_windows_openssl.txt. The default Windows SSL build uses the native Schannel API.
The readmes, makefile and ENV file comments and the HTML documentation set were updated to match. docs/README_windows_setup.html was regenerated from README_windows_setup.txt.
A stray prebuilt shared library binary was removed from build/ in the source tree.