View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0000787 | Far Manager | _Common | public | 2009-03-14 05:58 | 2009-03-14 18:35 |
Reporter | alexeypa | Assigned To | alexy | ||
Priority | normal | Severity | crash | Reproducibility | random |
Status | closed | Resolution | fixed | ||
Fixed in Version | 2.0 | ||||
Summary | 0000787: Buffer overrun in nsMBCSGroupProber::HandleData | ||||
Description | nsMBCSGroupProber::HandleData передает на единицу больший размер буфера в mProbers[i]->HandleData. AppVerifier это дело ловит. Repro: 1. Запустить Far 2.0 x64 под AppVerifier. У меня получалось вопроизвести только в релизной версии. 2. Открыть прикрепленный colorer.dll для просмотра (F3). 3. Far падает в недрах UTF8 prober. Заплатка в прикрепленном файле: 0001-nsMBCSGroupProber-HandleData-passed-invalid-buffer.patch PS. Кстати, UCD библиотека откуда взята? Надо бы им зарепортить этот баг. | ||||
Tags | No tags attached. | ||||
Build | 825 | ||||
2009-03-14 05:58
|
|
2009-03-14 05:58
|
0001-nsMBCSGroupProber-HandleData-passed-invalid-buffer.patch (960 bytes)
From 3e305cdcdaa5f07d8168b86ad62f71c2a9a328b3 Mon Sep 17 00:00:00 2001 From: Alexey Pakhunov <alexeypa@gmail.com> Date: Fri, 13 Mar 2009 22:45:13 -0700 Subject: [PATCH 1/2] nsMBCSGroupProber::HandleData passed invalid buffer length to HandleData that was caught by AppVerifier. --- unicode_far/UCD/nsMBCSGroupProber.cpp | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/unicode_far/UCD/nsMBCSGroupProber.cpp b/unicode_far/UCD/nsMBCSGroupProber.cpp index ffb80cf..608974e 100644 --- a/unicode_far/UCD/nsMBCSGroupProber.cpp +++ b/unicode_far/UCD/nsMBCSGroupProber.cpp @@ -156,7 +156,7 @@ nsProbingState nsMBCSGroupProber::HandleData(const char* aBuf, PRUint32 aLen) { if (!mIsActive[i]) continue; - st = mProbers[i]->HandleData(aBuf + start, aLen + 1 - start); + st = mProbers[i]->HandleData(aBuf + start, aLen - start); if (st == eFoundIt) { mBestGuess = i; -- 1.6.2.1217.gd7bc3 |
|
>>Кстати, UCD библиотека откуда взята? Надо бы им зарепортить этот баг. Mozilla Firefox 3.0.7 (а может 3.0.6, стер уже файл) |
|
825 |
Date Modified | Username | Field | Change |
---|---|---|---|
2009-03-14 05:58 | alexeypa | New Issue | |
2009-03-14 05:58 | alexeypa | Status | new => assigned |
2009-03-14 05:58 | alexeypa | Assigned To | => vskirdin |
2009-03-14 05:58 | alexeypa | File Added: colorer.dll | |
2009-03-14 05:58 | alexeypa | File Added: 0001-nsMBCSGroupProber-HandleData-passed-invalid-buffer.patch | |
2009-03-14 10:26 | warp | Note Added: 0002782 | |
2009-03-14 11:52 | alexy | Assigned To | vskirdin => alexy |
2009-03-14 11:52 | alexy | Category | Fast Find => _Common |
2009-03-14 18:35 | alexy | Build | => 825 |
2009-03-14 18:35 | alexy | Note Added: 0002783 | |
2009-03-14 18:35 | alexy | Status | assigned => closed |
2009-03-14 18:35 | alexy | Resolution | open => fixed |
2009-03-14 18:35 | alexy | Fixed in Version | => 2.0 |