bugGnash - The GNU Flash player - Bugs: bug #24257, Element::to_string returns...

 
 

bug #24257: Element::to_string returns unterminated character pointer

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Sun 14 Sep 2008 01:01:22 AM UTC  
 
Category: RTMP and AMFSeverity: 6 - Security
Release: trunkStatus: Fixed
Privacy: PublicAssigned to: Rob Savoye <rsavoye>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 14 Sep 2008 01:01:22 AM UTC, original submission:

In Element, const char *to_string() const; is presumably intended to return a pointer to the NULL-terminated string containing the value of the string Element type. However, the string is never actually NULL (or zero) terminated.

For example:

The element constructor will call init(string, string), which will in turn call the Buffer(str.size()) constructor, where the argument indicates the number of bytes to allocate. But str.size() is the number of characters in the string, not including the terminating NULL. Buffer::copy(string) is then called, which calls std::copy(str.begin, str.end(), _buf), which copies the characters, but obviously does not append a 0 (and if it did, it would overflow the buffer of size str.size()).

So, subsequently, when one calls Element::to_string(), a pointer to the buffer is returned, which is still not NULL-terminated!

And, in the case of AsValueTest.cpp, tests may or may not succeed depending on your luck. Obviously this could lead to buffer overflows...

Found by setting glibc's MALLOC_CHECK_=2.

Bastiaan Jacques <bjacques>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bwy (Updated the item)
  • -unavailable- added by nelsonrn (Updated the item)
  • -unavailable- added by bjacques (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 25 Aug 2010 07:15:28 AM UTCbwyStatusPostponed=>Fixed
      Open/ClosedOpen=>Closed
    Mon 13 Oct 2008 12:38:18 PM UTCnelsonrnStatusReady For Test=>Postponed
    Sun 05 Oct 2008 06:18:55 PM UTCbjacquesStatusNone=>Ready For Test

    Back to the top


    Powered by Savane 3.1-cleanup1