View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001405 | SOGo | SOPE | public | 2011-08-02 13:11 | 2011-10-05 13:10 |
| Reporter | buzzdee | Assigned To | |||
| Priority | normal | Severity | crash | Reproducibility | random |
| Status | closed | Resolution | fixed | ||
| Product Version | 1.3.8 | ||||
| Fixed in Version | 1.3.9 | ||||
| Summary | 0001405: random segfault due to off by one triggered from OGo in NGHttpHeaderFieldParser.m | ||||
| Description | A backtrace, and some other gdb output can be found in the OGo bug tracker here: The problem is that *src is incremented and accessed before the check (len > 0) is done in a couple of if statements and in the while loop in | ||||
| Additional Information | attached patch moves the check (len > 0) from the end of the if condition and the while loop to the front, preventing accessing the memory 1 byte after the end of the buffer. Could this please reviewed and added to the SOPE sources. | ||||
| Tags | No tags attached. | ||||
|
2011-08-02 13:11
|
patch-sope-appserver_NGObjWeb_NGHttp_NGHttpHeaderFieldParser_m (1,077 bytes)
$OpenBSD$
fix random crasher due to off by one triggered in OGo, observed by clicking the zip info triangle for a tar file
in an OGo project
--- sope-appserver/NGObjWeb/NGHttp/NGHttpHeaderFieldParser.m.orig Tue Nov 2 15:12:13 2010
+++ sope-appserver/NGObjWeb/NGHttp/NGHttpHeaderFieldParser.m Tue Aug 2 15:04:17 2011
@@ -190,7 +190,7 @@ static Class NSArrayClass = Nil;
const unsigned char *startPos = NULL;
// strip leading spaces
- while ((*src != '\0') && isRfc822_LWSP(*src) && (len > 0)) {
+ while ((len > 0) && (*src != '\0') && isRfc822_LWSP(*src)) {
src++;
len--;
}
@@ -199,7 +199,7 @@ static Class NSArrayClass = Nil;
else
startPos = src;
- while ((*src != self->splitChar) && !isRfc822_LWSP(*src) && (len > 0)) {
+ while ((len > 0) && (*src != self->splitChar) && !isRfc822_LWSP(*src)) {
src++;
len--;
}
@@ -235,7 +235,7 @@ static Class NSArrayClass = Nil;
}
}
}
- while ((*src != '\0') && (len > 0));
+ while ((len > 0) && (*src != '\0'));
return array;
}
|
|
Can somone look at the patch here? |
|
|
Patch integrated - see: http://mtn.inverse.ca/revision/diff/60ea81ded2b82c6979e398398fba9a7e84fa9af9/with/1ae4b707df5b49bc1f28f570464f1da33b5590e0 |
|
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2011-08-02 13:11 | buzzdee | New Issue | |
| 2011-08-02 13:11 | buzzdee | File Added: patch-sope-appserver_NGObjWeb_NGHttp_NGHttpHeaderFieldParser_m | |
| 2011-10-05 09:53 | buzzdee | Note Added: 0002865 | |
| 2011-10-05 13:10 | ludovic | Note Added: 0002867 | |
| 2011-10-05 13:10 | ludovic | Status | new => closed |
| 2011-10-05 13:10 | ludovic | Resolution | open => fixed |
| 2011-10-05 13:10 | ludovic | Fixed in Version | => 1.3.9 |