You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Klaus Rennecke <kr...@tigris.org> on 2004/07/04 16:43:50 UTC
Suspect buffer underrun in svn_path_uri_decode
While browsing through it to find out more about flow control, I
stumbled over this:
[...libsvn_subr/path.c@r10135 line 850...]
for (i = 0; path[i]; i++)
{
char c = path[i];
[...snip...]
else if (c == '%')
{
char digitz[3];
digitz[0] = path[++i];
digitz[1] = path[++i];
digitz[2] = '\0';|
[...]
So, where will this end up with an input of "http://c.r.a/s%" ? Granted,
it's not really a valid URL, but that's no reason to plow through the
heap, is it? :-)
/Klaus
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Suspect buffer underrun in svn_path_uri_decode
Posted by Julian Foad <ju...@btopenworld.com>.
Peter N. Lundblad wrote:
> On Fri, 1 Oct 2004, Julian Foad wrote:
>
>>Reading old mail, I found this with no reply.
>>
>>Klaus Rennecke wrote:
>>
>>>Shall I file this in the issue tracker? I believe it's a severe memory
>>>corruption risk.
>>
>>The snippet below only shows _reading_ from invalid memory, but this does then cause the output buffer to overflow, so it is bad.
>
> AFAICT, this is fixed on trunk and in 1.1. Checks were inserted in the if
> statement. I don't know in what revision it was fixed, though.
Oh, so it is (r10199 and r10200). Apologies for not checking this before posting.
- Julian
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Suspect buffer underrun in svn_path_uri_decode
Posted by "Peter N. Lundblad" <pe...@famlundblad.se>.
On Fri, 1 Oct 2004, Julian Foad wrote:
> Reading old mail, I found this with no reply.
>
> Klaus Rennecke wrote:
> > Shall I file this in the issue tracker? I believe it's a severe memory
> > corruption risk.
>
> The snippet below only shows _reading_ from invalid memory, but this does then cause the output buffer to overflow, so it is bad.
>
AFAICT, this is fixed on trunk and in 1.1. Checks were inserted in the if
statement. I don't know in what revision it was fixed, though.
//Peter
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Suspect buffer underrun in svn_path_uri_decode
Posted by Julian Foad <ju...@btopenworld.com>.
Reading old mail, I found this with no reply.
Klaus Rennecke wrote:
> Shall I file this in the issue tracker? I believe it's a severe memory
> corruption risk.
The snippet below only shows _reading_ from invalid memory, but this does then cause the output buffer to overflow, so it is bad.
So, yes, please file this in the issue tracker unless someone offers to fix it immediately.
- Julian
> Klaus Rennecke wrote:
>
>> [...libsvn_subr/path.c@r10135 line 850...]
(it's now around line 1000)
>> for (i = 0; path[i]; i++)
>> {
>> char c = path[i];
>> [...snip...]
>> else if (c == '%')
>> {
>> char digitz[3];
>> digitz[0] = path[++i];
>> digitz[1] = path[++i];
>> digitz[2] = '\0';|
>> [...]
>>
>> So, where will this end up with an input of "http://c.r.a/s%" ?
>> Granted, it's not really a valid URL, but that's no reason to plow
>> through the heap, is it? :-)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Suspect buffer underrun in svn_path_uri_decode
Posted by Klaus Rennecke <kr...@tigris.org>.
Shall I file this in the issue tracker? I believe it's a severe memory
corruption risk.
Klaus Rennecke wrote:
> [...]
> [...libsvn_subr/path.c@r10135 line 850...]
> for (i = 0; path[i]; i++)
> {
> char c = path[i];
> [...snip...]
> else if (c == '%')
> {
> char digitz[3];
> digitz[0] = path[++i];
> digitz[1] = path[++i];
> digitz[2] = '\0';|
> [...]
>
> So, where will this end up with an input of "http://c.r.a/s%" ?
> Granted, it's not really a valid URL, but that's no reason to plow
> through the heap, is it? :-)
> [...]
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org