View Issue Details

IDProjectCategoryView StatusLast Update
0001405SOGoSOPEpublic2011-10-05 13:10
Reporterbuzzdee Assigned To 
PrioritynormalSeveritycrashReproducibilityrandom
Status closedResolutionfixed 
Product Version1.3.8 
Fixed in Version1.3.9 
Summary0001405: random segfault due to off by one triggered from OGo in NGHttpHeaderFieldParser.m
Description

A backtrace, and some other gdb output can be found in the OGo bug tracker here:
https://sourceforge.net/apps/mantisbt/opengroupware/view.php?id=71

The problem is that *src is incremented and accessed before the check (len > 0) is done in a couple of if statements and in the while loop in
-[NGHttpStringArrayHeaderFieldParser parseValue:ofHeaderField:]

Additional Information

attached patch moves the check (len > 0) from the end of the if condition and the while loop to the front, preventing accessing the memory 1 byte after the end of the buffer.

Could this please reviewed and added to the SOPE sources.

TagsNo tags attached.

Activities

2011-08-02 13:11

 

patch-sope-appserver_NGObjWeb_NGHttp_NGHttpHeaderFieldParser_m (1,077 bytes)   
$OpenBSD$

fix random crasher due to off by one triggered in OGo, observed by clicking the zip info triangle for a tar file
in an OGo project

--- sope-appserver/NGObjWeb/NGHttp/NGHttpHeaderFieldParser.m.orig	Tue Nov  2 15:12:13 2010
+++ sope-appserver/NGObjWeb/NGHttp/NGHttpHeaderFieldParser.m	Tue Aug  2 15:04:17 2011
@@ -190,7 +190,7 @@ static Class NSArrayClass = Nil;
     const unsigned char *startPos = NULL;
     
     // strip leading spaces
-    while ((*src != '\0') && isRfc822_LWSP(*src) && (len > 0)) {
+    while ((len > 0) && (*src != '\0') && isRfc822_LWSP(*src)) {
       src++;
       len--;
     }
@@ -199,7 +199,7 @@ static Class NSArrayClass = Nil;
     else
       startPos = src;
     
-    while ((*src != self->splitChar) && !isRfc822_LWSP(*src) && (len > 0)) {
+    while ((len > 0) && (*src != self->splitChar) && !isRfc822_LWSP(*src)) {
       src++;
       len--;
     }
@@ -235,7 +235,7 @@ static Class NSArrayClass = Nil;
       }
     }
   }
-  while ((*src != '\0') && (len > 0));
+  while ((len > 0) && (*src != '\0'));
 
   return array;
 }
buzzdee

buzzdee

2011-10-05 09:53

reporter   ~0002865

Can somone look at the patch here?

ludovic

ludovic

2011-10-05 13:10

administrator   ~0002867

Patch integrated - see: http://mtn.inverse.ca/revision/diff/60ea81ded2b82c6979e398398fba9a7e84fa9af9/with/1ae4b707df5b49bc1f28f570464f1da33b5590e0

Issue History

Date Modified Username Field Change
2011-08-02 13:11 buzzdee New Issue
2011-08-02 13:11 buzzdee File Added: patch-sope-appserver_NGObjWeb_NGHttp_NGHttpHeaderFieldParser_m
2011-10-05 09:53 buzzdee Note Added: 0002865
2011-10-05 13:10 ludovic Note Added: 0002867
2011-10-05 13:10 ludovic Status new => closed
2011-10-05 13:10 ludovic Resolution open => fixed
2011-10-05 13:10 ludovic Fixed in Version => 1.3.9