[Bug 61353] New: escape_sgml_chars doesn't allocate large enough buffer

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61353

            Bug ID: 61353
           Summary: escape_sgml_chars doesn't allocate large enough buffer
           Product: Rivet
           Version: 2.2.3
          Hardware: PC
                OS: FreeBSD
            Status: NEW
          Severity: critical
          Priority: P2
         Component: Rivet Core Commands
          Assignee: rivet-dev@tcl.apache.org
          Reporter: jlawson-apache@bovine.net
                CC: mxmanghi@apache.org
  Target Milestone: mod_rivet

It's possible to perform a buffer overflow in escape_sgml_chars for very short
strings that contain mostly characters that require escaping because the
temporary buffer allocation is not large enough.

$ tclsh
% package require rivetlib
2.2.3
% puts [::rivet::escape_sgml_chars "&"]
alloc: invalid block: 0x80214f620: ef ef 3b
Abort trap (core dumped)


In Rivet_EscapeSgmlCharsCmd, the following buffer allocation is done, however
the worst case escapement will require 6 characters if the input string
consisted of entirely double-quote characters.

newString = (char *)Tcl_Alloc( (unsigned)origLength * 3 + 1 );

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: rivet-dev-unsubscribe@tcl.apache.org
For additional commands, e-mail: rivet-dev-help@tcl.apache.org

[Bug 61353] escape_sgml_chars doesn't allocate large enough buffer

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61353

--- Comment #4 from Jeff Lawson <jl...@bovine.net> ---
Created attachment 35186
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=35186&action=edit
change allocation size on correct function

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: rivet-dev-unsubscribe@tcl.apache.org
For additional commands, e-mail: rivet-dev-help@tcl.apache.org

[Bug 61353] escape_sgml_chars doesn't allocate large enough buffer

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61353

--- Comment #5 from Massimo Manghi <mx...@apache.org> ---
Thank you Jeff, it's my fault. Karl pointed out the right function but I
misread its name and patched the allocation in the other one. Having a patch
for that like the one you provided has been very helpful

the patch is now in the repository, I will prepare a new release candidate
tonight

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: rivet-dev-unsubscribe@tcl.apache.org
For additional commands, e-mail: rivet-dev-help@tcl.apache.org

[Bug 61353] escape_sgml_chars doesn't allocate large enough buffer

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61353

--- Comment #3 from Jeff Lawson <jl...@bovine.net> ---
It looks like this is the commit that was intended to fix this bug:

svn diff -c r1773063

However that commit was to Rivet_EscapeStringCmd, not Rivet_EscapeSgmlCharsCmd.

I think Rivet_EscapeStringCmd can safely stay at (origLength * 3 + 1), but
Rivet_EscapeSgmlCharsCmd is the one that needs to be (origLength * 6 + 1).

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: rivet-dev-unsubscribe@tcl.apache.org
For additional commands, e-mail: rivet-dev-help@tcl.apache.org

[Bug 61353] escape_sgml_chars doesn't allocate large enough buffer

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61353

Jeff Lawson <jl...@bovine.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Jeff Lawson <jl...@bovine.net> ---
okay thanks, confirmed the diff made it into Rivet 2.3.4rc2

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: rivet-dev-unsubscribe@tcl.apache.org
For additional commands, e-mail: rivet-dev-help@tcl.apache.org

[Bug 61353] escape_sgml_chars doesn't allocate large enough buffer

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61353

--- Comment #1 from Jeff Lawson <jl...@bovine.net> ---
This appears to still be an issue in Rivet 2.3.4

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: rivet-dev-unsubscribe@tcl.apache.org
For additional commands, e-mail: rivet-dev-help@tcl.apache.org

[Bug 61353] escape_sgml_chars doesn't allocate large enough buffer

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=61353

--- Comment #2 from Jeff Lawson <jl...@bovine.net> ---
This was originally reported by Karl to the mailing list in December 2016 and
reportedly fixed, however I don't see any changes to the offending Tcl_Alloc
line in the Rivet 2.3.4 release:

https://mail-archives.apache.org/mod_mbox/tcl-rivet-dev/201612.mbox/%3Cd2334aef-4c18-5824-d74d-fa8763180097@biol.unipr.it%3E

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: rivet-dev-unsubscribe@tcl.apache.org
For additional commands, e-mail: rivet-dev-help@tcl.apache.org