View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0000799 | Far Manager | Editor | public | 2009-03-25 15:35 | 2009-03-26 09:10 |
Reporter | alexeypa | Assigned To | vskirdin | ||
Priority | normal | Severity | crash | Reproducibility | always |
Status | closed | Resolution | fixed | ||
Fixed in Version | 2.0 | ||||
Summary | 0000799: Buffer overrun in Editor::BlockLeft. | ||||
Description | Editor::BlockLeft передает неверную длину строки в AddUndoData. Repro: 1. Запустить Far 2.0 x64 под AppVerifier. 1.1. Для усиления эффекта выставить ширину Tab-а побольше. 2. Открыть в редакторе repro.txt. 3. Выделить первую строку. 4. Нажать AltU Прикрепленнй патч 0001-Buffer-overrun-in-Editor-BlockLeft.Unvalid-length-w.patch это исправляет. | ||||
Tags | No tags attached. | ||||
Build | 835 | ||||
2009-03-25 15:35
|
0001-Buffer-overrun-in-Editor-BlockLeft.Unvalid-length-w.patch (1,023 bytes)
From 9988d9a8d691c0c45c62ce98a83f780c5e6f0dac Mon Sep 17 00:00:00 2001 From: Alexey Pakhunov <alexeypa@gmail.com> Date: Wed, 25 Mar 2009 08:18:25 -0700 Subject: [PATCH] Buffer overrun in Editor::BlockLeft. Unvalid length was passed to AddUndoData call. --- unicode_far/editor.cpp | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/unicode_far/editor.cpp b/unicode_far/editor.cpp index 8eda9fc..1f7b5e1 100644 --- a/unicode_far/editor.cpp +++ b/unicode_far/editor.cpp @@ -4951,7 +4951,7 @@ void Editor::BlockLeft() wmemcpy(TmpStr+Length,EndSeq,EndLength); Length+=EndLength; TmpStr[Length]=0; - AddUndoData(CurStr,CurPtr->GetEOL(),LineNum,0,UNDO_EDIT,Length); // EOL? - CurLine->GetEOL() GlobalEOL "" + AddUndoData(CurStr,CurPtr->GetEOL(),LineNum,0,UNDO_EDIT,CurPtr->GetLength()); // EOL? - CurLine->GetEOL() GlobalEOL "" BlockUndo=TRUE; int CurPos=CurPtr->GetCurPos(); CurPtr->SetBinaryString(TmpStr,Length); -- 1.6.2.1217.gd7bc3 |
2009-03-25 15:36
|
|
|
в 1.7 такая же фигня - там тоже править? |
|
> в 1.7 такая же фигня - там тоже править? Как по мне, выход за пределы буфера надо править во всех версиях. |
|
build 835 в 1.7 позже |
Date Modified | Username | Field | Change |
---|---|---|---|
2009-03-25 15:35 | alexeypa | New Issue | |
2009-03-25 15:35 | alexeypa | Status | new => assigned |
2009-03-25 15:35 | alexeypa | Assigned To | => vskirdin |
2009-03-25 15:35 | alexeypa | File Added: 0001-Buffer-overrun-in-Editor-BlockLeft.Unvalid-length-w.patch | |
2009-03-25 15:36 | alexeypa | File Added: repro.txt | |
2009-03-25 15:58 | vskirdin | Note Added: 0002824 | |
2009-03-25 17:15 | alexeypa | Note Added: 0002825 | |
2009-03-25 18:00 | vskirdin | Note Added: 0002827 | |
2009-03-25 18:00 | vskirdin | Status | assigned => feedback |
2009-03-26 02:36 | alexeypa | Status | feedback => resolved |
2009-03-26 02:36 | alexeypa | Resolution | open => fixed |
2009-03-26 09:10 | vskirdin | Build | => 835 |
2009-03-26 09:10 | vskirdin | Status | resolved => closed |
2009-03-26 09:10 | vskirdin | Fixed in Version | => 2.0 |