View Issue Details

IDProjectCategoryView StatusLast Update
0000799Far ManagerEditorpublic2009-03-26 09:10
Reporteralexeypa Assigned Tovskirdin  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Fixed in Version2.0 
Summary0000799: Buffer overrun in Editor::BlockLeft.
DescriptionEditor::BlockLeft передает неверную длину строки в AddUndoData.

Repro:

1. Запустить Far 2.0 x64 под AppVerifier.
  1.1. Для усиления эффекта выставить ширину Tab-а побольше.
2. Открыть в редакторе repro.txt.
3. Выделить первую строку.
4. Нажать AltU

Прикрепленнй патч 0001-Buffer-overrun-in-Editor-BlockLeft.Unvalid-length-w.patch это исправляет.
TagsNo tags attached.
Build835

Activities

2009-03-25 15:35

 

0001-Buffer-overrun-in-Editor-BlockLeft.Unvalid-length-w.patch (1,023 bytes)   
From 9988d9a8d691c0c45c62ce98a83f780c5e6f0dac Mon Sep 17 00:00:00 2001
From: Alexey Pakhunov <alexeypa@gmail.com>
Date: Wed, 25 Mar 2009 08:18:25 -0700
Subject: [PATCH] Buffer overrun in Editor::BlockLeft. Unvalid length was passed to AddUndoData call.

---
 unicode_far/editor.cpp |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/unicode_far/editor.cpp b/unicode_far/editor.cpp
index 8eda9fc..1f7b5e1 100644
--- a/unicode_far/editor.cpp
+++ b/unicode_far/editor.cpp
@@ -4951,7 +4951,7 @@ void Editor::BlockLeft()
       wmemcpy(TmpStr+Length,EndSeq,EndLength);
       Length+=EndLength;
       TmpStr[Length]=0;
-      AddUndoData(CurStr,CurPtr->GetEOL(),LineNum,0,UNDO_EDIT,Length); // EOL? - CurLine->GetEOL()  GlobalEOL   ""
+      AddUndoData(CurStr,CurPtr->GetEOL(),LineNum,0,UNDO_EDIT,CurPtr->GetLength()); // EOL? - CurLine->GetEOL()  GlobalEOL   ""
       BlockUndo=TRUE;
       int CurPos=CurPtr->GetCurPos();
       CurPtr->SetBinaryString(TmpStr,Length);
-- 
1.6.2.1217.gd7bc3

2009-03-25 15:36

 

repro.txt (4 bytes)   
	[
repro.txt (4 bytes)   

vskirdin

2009-03-25 15:58

administrator   bugnote:0002824

в 1.7 такая же фигня - там тоже править?

alexeypa

2009-03-25 17:15

reporter   bugnote:0002825

> в 1.7 такая же фигня - там тоже править?

Как по мне, выход за пределы буфера надо править во всех версиях.

vskirdin

2009-03-25 18:00

administrator   bugnote:0002827

build 835
в 1.7 позже

Issue History

Date Modified Username Field Change
2009-03-25 15:35 alexeypa New Issue
2009-03-25 15:35 alexeypa Status new => assigned
2009-03-25 15:35 alexeypa Assigned To => vskirdin
2009-03-25 15:35 alexeypa File Added: 0001-Buffer-overrun-in-Editor-BlockLeft.Unvalid-length-w.patch
2009-03-25 15:36 alexeypa File Added: repro.txt
2009-03-25 15:58 vskirdin Note Added: 0002824
2009-03-25 17:15 alexeypa Note Added: 0002825
2009-03-25 18:00 vskirdin Note Added: 0002827
2009-03-25 18:00 vskirdin Status assigned => feedback
2009-03-26 02:36 alexeypa Status feedback => resolved
2009-03-26 02:36 alexeypa Resolution open => fixed
2009-03-26 09:10 vskirdin Build => 835
2009-03-26 09:10 vskirdin Status resolved => closed
2009-03-26 09:10 vskirdin Fixed in Version => 2.0