View Issue Details

IDProjectCategoryView StatusLast Update
0000406Far ManagerEditorpublic2007-12-03 23:25
Reporteralexmitin Assigned Toalexy  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Fixed in Version1.80 alpha 1 
Summary0000406: Memory corruption and crash in Editor::AddUndoData()
DescriptionSteps to reproduce:
1) Add the following registry key:

[HKEY_CURRENT_USER\Software\Far18\Editor]
"EditorUndoSize"=dword:00000040

2) Start FAR under debugger.
3) Open text file, for example c:\111.txt
4) Type 123456790. Press Enter.
5) Select the first line. Copy and paste it 64 times.
There is a crash.


File: editor.cpp
Line: 4283
Function: Editor::AddUndoData()
Context:
void Editor::AddUndoData(const wchar_t *Str,const wchar_t *Eol,int StrNum,int StrPos,int Type)
{
...
==[crash]==> UndoData[UndoDataPos].EOL[sizeof(GlobalEOL)-1]=0;
...
}

Observations:
==============
GlobalEOL is defined in editor.hpp, line 144:

    wchar_t GlobalEOL[10];

EditorUndoData is defined as following:

struct EditorUndoData
{
  int Type;
  int UndoNext;
  int StrPos;
  int StrNum;
  wchar_t EOL[10];
  wchar_t *Str;
};

sizeof(GlobalEOL) == 20

The follwing code

UndoData[UndoDataPos].EOL[sizeof(GlobalEOL)-1]=0;

overwrites the memory that does not belong to the structure.
Additional InformationFAR 1.80.0.376
TagsNo tags attached.
Build377

Activities

alexy

2007-12-03 23:25

administrator   bugnote:0000944

377

Issue History

Date Modified Username Field Change
2007-12-03 20:42 alexmitin New Issue
2007-12-03 20:42 alexmitin Status new => assigned
2007-12-03 20:42 alexmitin Assigned To => vskirdin
2007-12-03 23:13 alexy Assigned To vskirdin => alexy
2007-12-03 23:25 alexy Build => 377
2007-12-03 23:25 alexy Status assigned => closed
2007-12-03 23:25 alexy Note Added: 0000944
2007-12-03 23:25 alexy Resolution open => fixed
2007-12-03 23:25 alexy Fixed in Version => 1.80 alpha 1