bugGNU roff - Bugs: bug #52433, Commit [09040dbf] is wrong: bad...

 
 

bug #52433: Commit [09040dbf] is wrong: bad bounds check in pre-html.cpp

Submitter:  None
Submitted:  Fri 17 Nov 2017 06:51:01 PM UTC
   
 
Category:  Preprocessor html Severity:  3 - Normal
Item Group:  Incorrect behaviour Status:  Need Info
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 05 Nov 2018 08:35:09 AM UTC, comment #1: 

Any one got ideas about this?  I'm afraid I don't understand the code well enough to craft an exploit for it, but our anonymous submitter has a suggestion.

Here's the commit to which he refers.


commit 09040dbf908c2563e0d918a1dca7bb564226a0f8
Author: Bálint Réczey <balint@balintreczey.hu>
Date:   Tue Feb 16 00:16:28 2016 +0100

    [pre-grohtml] Fix out-of-bounds array access (#47161).

    * src/preproc/html/pre-html.cpp (char_buffer::write_upto_newline):
    Implement it.

diff --git a/ChangeLog b/ChangeLog
index b3cdf1d7..b264974d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2016-02-15  Bálint Réczey  <balint@balintreczey.hu>
+
+       [pre-grohtml] Fix out-of-bounds array access (#47161).
+
+       * src/preproc/html/pre-html.cpp (char_buffer::write_upto_newline):
+       Implement it.
+
 2016-02-15  Bálint Réczey  <balint@balintreczey.hu>

        Don't use `memcpy' with NULL input or output argument (#47160).
diff --git a/src/preproc/html/pre-html.cpp b/src/preproc/html/pre-html.cpp
index 978721a1..8698149a 100644
--- a/src/preproc/html/pre-html.cpp
+++ b/src/preproc/html/pre-html.cpp
@@ -661,7 +661,7 @@ void char_buffer::write_upto_newline(char_block **t, int *i, int is_html)
        && (*t)->buffer[j] == '\n')
       j++;
     writeNbytes((*t)->buffer + (*i), j - (*i));
-    if ((*t)->buffer[j] == INLINE_LEADER_CHAR) {
+    if (j < char_block::SIZE && (*t)->buffer[j] == INLINE_LEADER_CHAR) {
       if (can_see(t, &j, HTML_IMAGE_INLINE_BEGIN))
        write_start_image(INLINE, is_html);
       else if (can_see(t, &j, HTML_IMAGE_INLINE_END))


G. Branden Robinson <gbranden>
Group administrator
Fri 17 Nov 2017 06:51:01 PM UTC, original submission:  

I am here for something else, the commit mentioned changed

  -    if ((*t)->buffer[j] == INLINE_LEADER_CHAR) {
  +    if (j < char_block::SIZE && (*t)->buffer[j] == INLINE_LEADER_CHAR) {

where it should have been

  +    if (j < (*t)->used && (*t)->buffer[j] == INLINE_LEADER_CHAR) {

instead.  But better would be redoing the entire thing, if that
comment is allowed, including indentation fixes.  Note especially
that, if all the buffer of *t consumed, and *t stepped to next
buffer, an array index of that next *t with this j is
performed.  That cannot be correct?

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gbranden (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-11-05 gbranden CategoryNone Preprocessor html
        Item GroupNone Incorrect behaviour
        StatusNone Need Info
        SummaryCommit [09040dbf] is wrong Commit [09040dbf] is wrong: bad bounds check in pre-html.cpp

    Back to the top

    Powered by Savane 3.13-04b1.
    Corresponding source code