View Issue Details

IDProjectCategoryView StatusLast Update
0000488Far ManagerFindFilespublic2008-03-12 02:07
Reporteralexmitin Assigned Toalexy  
PrioritynormalSeveritycrashReproducibilityrandom
Status closedResolutionfixed 
Fixed in Version1.80 alpha 1 
Summary0000488: Crash in GetRegKey()
DescriptionApplication crash. Steps to reproduce:

1) Import "cp-1251 (Windows russian).reg" file into registry.
2) Start FAR under debugger
3) Put a breakpoint in the following place:
   File: registry.cpp
   Function: GetRegKey
   Line: memcpy(ValueData,Default,DataSize);

4) Press Atl+F7
5) When the debugger stops at the breakpoint analyze the size of input and output buffer.

Result: Random access violation.

File: registry.cpp
Context:

int GetRegKey(const wchar_t *Key,const wchar_t *ValueName,BYTE *ValueData,const BYTE *Default,DWORD DataSize,DWORD *pType)
{
...
  if (hKey==NULL || ExitCode!=ERROR_SUCCESS)
  {
    if (Default!=NULL)
      memcpy(ValueData,Default,DataSize); <==[crash]==
    else
      memset(ValueData,0,DataSize);
    return(0);
  }
...
}


Analysis
=============================================================

Function PrepareTable():
------------------------
 strTableKey {m_pData=0x00b00360 } UnicodeString
   .m_pData
     .m_nLength = 38
     .m_nSize = 40
     .m_nDelta = 20
     .m_nRefCount = 1
     .m_pData = "CodeTables\CP-1251 (Windows russian)"
 lpTableKey="CP-1251 (Windows russian)"
 UseTableName=1

The size of the buffer allocated for lpTableKey is 39 bytes (including terminating '\0').

The registry does not have a "TableName" value in the key:

HKEY_CURRENT_USER\Software\Far18\CodeTables\CP-1251 (Windows russian)

For the full content of the "CP-1251 (Windows russian)" registry key see "cp-1251 (Windows russian).reg" file in the attachment.


Variables at the time of crash:

Function GetRegKey():
---------------------
 ValueData = "CP-1251 (Windows russian)"
 Default = "CP-1251 (Windows russian)"
 DataSize = 128
 ExitCode = 2
 hKey = 0x00000f98


The following code

      memcpy(ValueData,Default,DataSize); <==[crash]==

tries to copy 128 bytes ("DataSize") from "Default" (buffer size 39 bytes) to "ValueData" (buffer size 128 bytes). This causes the buffer overrun and as a result - an access violation and the random application crashes.


Call stack
-------------------------
     Far.exe!memcpy(unsigned char * dst=0x0012ce60, unsigned char * src=0x00b09fe0, unsigned long count=128) Line 188 Asm
> Far.exe!GetRegKey(const wchar_t * Key=0x00aeb278, const wchar_t * ValueName=0x0053b560, unsigned char * ValueData=0x0012ce60, const unsigned char * Default=0x00b09fe0, unsigned long DataSize=128, unsigned long * pType=0x00000000) Line 273 + 0x11 bytes C++
     Far.exe!PrepareTable(CharTableSet * TableSet=0x0012ca60, int TableNum=0, int UseTableName=1) Line 396 + 0x2b bytes C++
     Far.exe!FarCharTable(int Command=0, char * Buffer=0x0012dc2c, int BufferSize=1152) Line 1990 + 0x12 bytes C++
     Far.exe!FindFiles::FindFiles() Line 478 + 0x15 bytes C++
     Far.exe!FilePanels::ProcessKey(int Key=33620086) Line 607 C++
     Far.exe!Manager::ProcessKey(unsigned long Key=33620086) Line 920 C++
     Far.exe!Manager::ProcessMainLoop() Line 578 C++
     Far.exe!Manager::EnterMainLoop() Line 559 C++
     Far.exe!MainProcess(const wchar_t * lpwszEditName=0x009f4a18, const wchar_t * lpwszViewName=0x009f4ab0, const wchar_t * lpwszDestName1=0x009f4b48, const wchar_t * lpwszDestName2=0x009f4be0, int StartLine=-1, int StartChar=-1, int RegOpt=0) Line 273 C++
     Far.exe!wmain(int Argc=1, wchar_t * * Argv=0x009f52f8) Line 576 + 0x35 bytes C++
     Far.exe!__tmainCRTStartup() Line 327 + 0x19 bytes C
     Far.exe!wmainCRTStartup() Line 196 C
     kernel32.dll!_BaseProcessStart@4() + 0x23 bytes
Additional InformationFAR 1.80.0.429
TagsNo tags attached.
Build430

Activities

2008-03-10 22:48

 

cp-1251.zip (945 bytes)

alexy

2008-03-11 03:39

administrator   bugnote:0001275

fixed. 430.

alexmitin

2008-03-11 21:17

reporter   bugnote:0001282

Verified in 1.80.0.433.

Issue History

Date Modified Username Field Change
2008-03-10 22:48 alexmitin New Issue
2008-03-10 22:48 alexmitin File Added: cp-1251.zip
2008-03-11 02:24 alexy Status new => assigned
2008-03-11 02:24 alexy Assigned To => alexy
2008-03-11 03:39 alexy Note Added: 0001275
2008-03-11 03:39 alexy Status assigned => feedback
2008-03-11 21:17 alexmitin Status feedback => resolved
2008-03-11 21:17 alexmitin Resolution open => fixed
2008-03-11 21:17 alexmitin Note Added: 0001282
2008-03-12 02:06 alexy Build => 430
2008-03-12 02:06 alexy Status resolved => closed
2008-03-12 02:07 alexy Fixed in Version => 1.80 alpha 1