View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0000488 | Far Manager | FindFiles | public | 2008-03-10 22:48 | 2008-03-12 02:07 |
Reporter | alexmitin | Assigned To | alexy | ||
Priority | normal | Severity | crash | Reproducibility | random |
Status | closed | Resolution | fixed | ||
Fixed in Version | 1.80 alpha 1 | ||||
Summary | 0000488: Crash in GetRegKey() | ||||
Description | Application crash. Steps to reproduce: 1) Import "cp-1251 (Windows russian).reg" file into registry. 2) Start FAR under debugger 3) Put a breakpoint in the following place: File: registry.cpp Function: GetRegKey Line: memcpy(ValueData,Default,DataSize); 4) Press Atl+F7 5) When the debugger stops at the breakpoint analyze the size of input and output buffer. Result: Random access violation. File: registry.cpp Context: int GetRegKey(const wchar_t *Key,const wchar_t *ValueName,BYTE *ValueData,const BYTE *Default,DWORD DataSize,DWORD *pType) { ... if (hKey==NULL || ExitCode!=ERROR_SUCCESS) { if (Default!=NULL) memcpy(ValueData,Default,DataSize); <==[crash]== else memset(ValueData,0,DataSize); return(0); } ... } Analysis ============================================================= Function PrepareTable(): ------------------------ strTableKey {m_pData=0x00b00360 } UnicodeString .m_pData .m_nLength = 38 .m_nSize = 40 .m_nDelta = 20 .m_nRefCount = 1 .m_pData = "CodeTables\CP-1251 (Windows russian)" lpTableKey="CP-1251 (Windows russian)" UseTableName=1 The size of the buffer allocated for lpTableKey is 39 bytes (including terminating '\0'). The registry does not have a "TableName" value in the key: HKEY_CURRENT_USER\Software\Far18\CodeTables\CP-1251 (Windows russian) For the full content of the "CP-1251 (Windows russian)" registry key see "cp-1251 (Windows russian).reg" file in the attachment. Variables at the time of crash: Function GetRegKey(): --------------------- ValueData = "CP-1251 (Windows russian)" Default = "CP-1251 (Windows russian)" DataSize = 128 ExitCode = 2 hKey = 0x00000f98 The following code memcpy(ValueData,Default,DataSize); <==[crash]== tries to copy 128 bytes ("DataSize") from "Default" (buffer size 39 bytes) to "ValueData" (buffer size 128 bytes). This causes the buffer overrun and as a result - an access violation and the random application crashes. Call stack ------------------------- Far.exe!memcpy(unsigned char * dst=0x0012ce60, unsigned char * src=0x00b09fe0, unsigned long count=128) Line 188 Asm > Far.exe!GetRegKey(const wchar_t * Key=0x00aeb278, const wchar_t * ValueName=0x0053b560, unsigned char * ValueData=0x0012ce60, const unsigned char * Default=0x00b09fe0, unsigned long DataSize=128, unsigned long * pType=0x00000000) Line 273 + 0x11 bytes C++ Far.exe!PrepareTable(CharTableSet * TableSet=0x0012ca60, int TableNum=0, int UseTableName=1) Line 396 + 0x2b bytes C++ Far.exe!FarCharTable(int Command=0, char * Buffer=0x0012dc2c, int BufferSize=1152) Line 1990 + 0x12 bytes C++ Far.exe!FindFiles::FindFiles() Line 478 + 0x15 bytes C++ Far.exe!FilePanels::ProcessKey(int Key=33620086) Line 607 C++ Far.exe!Manager::ProcessKey(unsigned long Key=33620086) Line 920 C++ Far.exe!Manager::ProcessMainLoop() Line 578 C++ Far.exe!Manager::EnterMainLoop() Line 559 C++ Far.exe!MainProcess(const wchar_t * lpwszEditName=0x009f4a18, const wchar_t * lpwszViewName=0x009f4ab0, const wchar_t * lpwszDestName1=0x009f4b48, const wchar_t * lpwszDestName2=0x009f4be0, int StartLine=-1, int StartChar=-1, int RegOpt=0) Line 273 C++ Far.exe!wmain(int Argc=1, wchar_t * * Argv=0x009f52f8) Line 576 + 0x35 bytes C++ Far.exe!__tmainCRTStartup() Line 327 + 0x19 bytes C Far.exe!wmainCRTStartup() Line 196 C kernel32.dll!_BaseProcessStart@4() + 0x23 bytes | ||||
Additional Information | FAR 1.80.0.429 | ||||
Tags | No tags attached. | ||||
Build | 430 | ||||
Date Modified | Username | Field | Change |
---|---|---|---|
2008-03-10 22:48 | alexmitin | New Issue | |
2008-03-10 22:48 | alexmitin | File Added: cp-1251.zip | |
2008-03-11 02:24 | alexy | Status | new => assigned |
2008-03-11 02:24 | alexy | Assigned To | => alexy |
2008-03-11 03:39 | alexy | Note Added: 0001275 | |
2008-03-11 03:39 | alexy | Status | assigned => feedback |
2008-03-11 21:17 | alexmitin | Status | feedback => resolved |
2008-03-11 21:17 | alexmitin | Resolution | open => fixed |
2008-03-11 21:17 | alexmitin | Note Added: 0001282 | |
2008-03-12 02:06 | alexy | Build | => 430 |
2008-03-12 02:06 | alexy | Status | resolved => closed |
2008-03-12 02:07 | alexy | Fixed in Version | => 1.80 alpha 1 |