View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0000406 | Far Manager | Editor | public | 2007-12-03 20:42 | 2007-12-03 23:25 |
Reporter | alexmitin | Assigned To | alexy | ||
Priority | normal | Severity | crash | Reproducibility | always |
Status | closed | Resolution | fixed | ||
Fixed in Version | 1.80 alpha 1 | ||||
Summary | 0000406: Memory corruption and crash in Editor::AddUndoData() | ||||
Description | Steps to reproduce: 1) Add the following registry key: [HKEY_CURRENT_USER\Software\Far18\Editor] "EditorUndoSize"=dword:00000040 2) Start FAR under debugger. 3) Open text file, for example c:\111.txt 4) Type 123456790. Press Enter. 5) Select the first line. Copy and paste it 64 times. There is a crash. File: editor.cpp Line: 4283 Function: Editor::AddUndoData() Context: void Editor::AddUndoData(const wchar_t *Str,const wchar_t *Eol,int StrNum,int StrPos,int Type) { ... ==[crash]==> UndoData[UndoDataPos].EOL[sizeof(GlobalEOL)-1]=0; ... } Observations: ============== GlobalEOL is defined in editor.hpp, line 144: wchar_t GlobalEOL[10]; EditorUndoData is defined as following: struct EditorUndoData { int Type; int UndoNext; int StrPos; int StrNum; wchar_t EOL[10]; wchar_t *Str; }; sizeof(GlobalEOL) == 20 The follwing code UndoData[UndoDataPos].EOL[sizeof(GlobalEOL)-1]=0; overwrites the memory that does not belong to the structure. | ||||
Additional Information | FAR 1.80.0.376 | ||||
Tags | No tags attached. | ||||
Build | 377 | ||||
Date Modified | Username | Field | Change |
---|---|---|---|
2007-12-03 20:42 | alexmitin | New Issue | |
2007-12-03 20:42 | alexmitin | Status | new => assigned |
2007-12-03 20:42 | alexmitin | Assigned To | => vskirdin |
2007-12-03 23:13 | alexy | Assigned To | vskirdin => alexy |
2007-12-03 23:25 | alexy | Build | => 377 |
2007-12-03 23:25 | alexy | Status | assigned => closed |
2007-12-03 23:25 | alexy | Note Added: 0000944 | |
2007-12-03 23:25 | alexy | Resolution | open => fixed |
2007-12-03 23:25 | alexy | Fixed in Version | => 1.80 alpha 1 |