Re: [twsocket] Serious bug in TWSocket(AVorbufferoverflow)Pleasehelp !

2009-11-02 Thread Tobias Rapp
I have found some similar code in function TCustomLineWSocket.DoRecv() from
ICS-V5:

===
--- D:/DelphiComponents/Ics/Delphi/Vc32/WSocket.pas (revision 279)
+++ D:/DelphiComponents/Ics/Delphi/Vc32/WSocket.pas (working copy)
@@ -7874,13 +7874,13 @@
 { We are in line mode an a line is received }
 if FLineLength = BufferSize then begin
 { User buffer is greater than received data, copy all and clear }
-Move(FRcvdPtr^, Buffer, FLineLength);
+Move(FRcvdPtr^, Buffer^, FLineLength);
 Result  := FLineLength;
 FLineLength := 0;
 Exit;
 end;
 { User buffer is smaller, copy as much as possible }
-Move(FRcvdPtr^, Buffer, BufferSize);
+Move(FRcvdPtr^, Buffer^, BufferSize);
 Result   := BufferSize;
 { Move the end of line to beginning of buffer to be read the next time 
}
 Move(FRcvdPtr[BufferSize], FRcvdPtr^, FLineLength - BufferSize);
@@ -7897,13 +7897,13 @@
 { We already have received data into our internal buffer }
 if FRcvdCnt = BufferSize then begin
 { User buffer is greater than received data, copy all and clear }
-Move(FRcvdPtr^, Buffer, FRcvdCnt);
+Move(FRcvdPtr^, Buffer^, FRcvdCnt);
 Result   := FRcvdCnt;
 FRcvdCnt := 0;
 Exit;
 end;
 { User buffer is smaller, copy as much as possible }
-Move(FRcvdPtr^, Buffer, BufferSize);
+Move(FRcvdPtr^, Buffer^, BufferSize);
 Result   := BufferSize;
 { Then move remaining data to front og buffer  16/10/99 }
 Move(FRcvdPtr[BufferSize], FRcvdPtr^, FRcvdCnt - BufferSize + 1);


Regards,
Tobias


Max Terentiev wrote:
 Hi Arno,
 
 I think all Move() calls in ICS code should be checked...
 Bugs maybe not only in this place
 
 ---
 With best regards, Max Terentiev.
 Business Software Products.
 AMS Development Team.
 supp...@bspdev.com
 
 

--
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] Serious bug in TWSocket(AVorbufferoverflow)Pleasehelp !

2009-11-02 Thread Arno Garrels
Tobias Rapp wrote:
 I have found some similar code in function
 TCustomLineWSocket.DoRecv() from ICS-V5:

I don't think it is a bug in ICS-V5, since Buffer mostly was of 
no type (if memory serves well). This changed in ICS V6 where 
Buffer is of type TWSocketData which maps to Pointer in Win32.

--
Arno Garrels


--
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] Serious bug in TWSocket(AVorbufferoverflow)Pleasehelp !

2009-11-02 Thread Tobias Rapp
Arno Garrels wrote:
 I don't think it is a bug in ICS-V5, since Buffer mostly was of 
 no type (if memory serves well). This changed in ICS V6 where 
 Buffer is of type TWSocketData which maps to Pointer in Win32.

That's true. As a programmer coming from C language the typeless var Buffer 
thing often buffles me :-)

Tobias


--
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be