View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0001405 | SOGo | SOPE | public | 2011-08-02 13:11 | 2011-10-05 13:10 |
Reporter | buzzdee | Assigned To | |||
Priority | normal | Severity | crash | Reproducibility | random |
Status | closed | Resolution | fixed | ||
Product Version | 1.3.8 | ||||
Fixed in Version | 1.3.9 | ||||
Summary | 0001405: random segfault due to off by one triggered from OGo in NGHttpHeaderFieldParser.m | ||||
Description | A backtrace, and some other gdb output can be found in the OGo bug tracker here: The problem is that *src is incremented and accessed before the check (len > 0) is done in a couple of if statements and in the while loop in | ||||
Additional Information | attached patch moves the check (len > 0) from the end of the if condition and the while loop to the front, preventing accessing the memory 1 byte after the end of the buffer. Could this please reviewed and added to the SOPE sources. | ||||
Tags | No tags attached. | ||||
2011-08-02 13:11
|
patch-sope-appserver_NGObjWeb_NGHttp_NGHttpHeaderFieldParser_m (1,077 bytes)
$OpenBSD$ fix random crasher due to off by one triggered in OGo, observed by clicking the zip info triangle for a tar file in an OGo project --- sope-appserver/NGObjWeb/NGHttp/NGHttpHeaderFieldParser.m.orig Tue Nov 2 15:12:13 2010 +++ sope-appserver/NGObjWeb/NGHttp/NGHttpHeaderFieldParser.m Tue Aug 2 15:04:17 2011 @@ -190,7 +190,7 @@ static Class NSArrayClass = Nil; const unsigned char *startPos = NULL; // strip leading spaces - while ((*src != '\0') && isRfc822_LWSP(*src) && (len > 0)) { + while ((len > 0) && (*src != '\0') && isRfc822_LWSP(*src)) { src++; len--; } @@ -199,7 +199,7 @@ static Class NSArrayClass = Nil; else startPos = src; - while ((*src != self->splitChar) && !isRfc822_LWSP(*src) && (len > 0)) { + while ((len > 0) && (*src != self->splitChar) && !isRfc822_LWSP(*src)) { src++; len--; } @@ -235,7 +235,7 @@ static Class NSArrayClass = Nil; } } } - while ((*src != '\0') && (len > 0)); + while ((len > 0) && (*src != '\0')); return array; } |
Can somone look at the patch here? |
|
Patch integrated - see: http://mtn.inverse.ca/revision/diff/60ea81ded2b82c6979e398398fba9a7e84fa9af9/with/1ae4b707df5b49bc1f28f570464f1da33b5590e0 |
|
Date Modified | Username | Field | Change |
---|---|---|---|
2011-08-02 13:11 | buzzdee | New Issue | |
2011-08-02 13:11 | buzzdee | File Added: patch-sope-appserver_NGObjWeb_NGHttp_NGHttpHeaderFieldParser_m | |
2011-10-05 09:53 | buzzdee | Note Added: 0002865 | |
2011-10-05 13:10 | ludovic | Note Added: 0002867 | |
2011-10-05 13:10 | ludovic | Status | new => closed |
2011-10-05 13:10 | ludovic | Resolution | open => fixed |
2011-10-05 13:10 | ludovic | Fixed in Version | => 1.3.9 |