Re: [fossil-users] src/wikiformat.c Is_ticket : It may be better to check the size before memcpy
I see, now. You are right. This is a change from UUID_SIZE to HNAME_MAX that I missed when I was adding the SHA3 capabilities a few months ago. I think the problem should be fixed now on trunk. Let me know if you see anything else that I've missed. Thanks. On 6/11/17, [email protected] wrote: > It is not a problem on the surface now, > but internally it causes Buffer Overruns. > > (1) commit > fossil commit -m "[$(fossil whatis trunk | grep -P "^artifact" | grep -o "[^ > ]*$")] " --allow-empty > > (2) insert test code and recomile > Index: src/wikiformat.c > == > --- src/wikiformat.c > +++ src/wikiformat.c > @@ -1113,10 +1113,17 @@ >int n; >int rc; >char zLower[UUID_SIZE+1]; >char zUpper[UUID_SIZE+1]; >n = strlen(zTarget); > + if (n+1 > sizeof(zLower)){ > + @ Error Buffer Overruns: > + @ n+1 is %d(n+1): > + @ zLower size%d(sizeof(zLower)). > + @ UUID_SIZE:%d(UUID_SIZE). > + @ > + } >memcpy(zLower, zTarget, n+1); >canonical16(zLower, n+1); >memcpy(zUpper, zLower, n+1); >zUpper[n-1]++; >if( once ){ > > (3) access web timeline page > > Result > Leaf: > Error Buffer Overruns: n+1 is 65: zLower size41. UUID_SIZE:40. > [a10fc448ed3fce5113c2a44d18df0172c64a55624c4e21572566144106791b04] -- D. Richard Hipp [email protected] ___ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
Re: [fossil-users] src/wikiformat.c Is_ticket : It may be better to check the size before memcpy
It is not a problem on the surface now,
but internally it causes Buffer Overruns.
(1) commit
fossil commit -m "[$(fossil whatis trunk | grep -P "^artifact" | grep -o "[^
]*$")] " --allow-empty
(2) insert test code and recomile
Index: src/wikiformat.c
==
--- src/wikiformat.c
+++ src/wikiformat.c
@@ -1113,10 +1113,17 @@
int n;
int rc;
char zLower[UUID_SIZE+1];
char zUpper[UUID_SIZE+1];
n = strlen(zTarget);
+ if (n+1 > sizeof(zLower)){
+ @ Error Buffer Overruns:
+ @ n+1 is %d(n+1):
+ @ zLower size%d(sizeof(zLower)).
+ @ UUID_SIZE:%d(UUID_SIZE).
+ @
+ }
memcpy(zLower, zTarget, n+1);
canonical16(zLower, n+1);
memcpy(zUpper, zLower, n+1);
zUpper[n-1]++;
if( once ){
(3) access web timeline page
Result
Leaf:
Error Buffer Overruns: n+1 is 65: zLower size41. UUID_SIZE:40.
[a10fc448ed3fce5113c2a44d18df0172c64a55624c4e21572566144106791b04] ___
fossil-users mailing list
[email protected]
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
Re: [fossil-users] src/wikiformat.c Is_ticket : It may be better to check the size before memcpy
On 6/10/17, [email protected] wrote: > src/wikiformat.c : is_ticket > > in_this_repo is checked whether n is maximum size of char array, > > https://www.fossil-scm.org/index.html/artifact?ln=1090-1092&name=1616c95201d38f46 > > but is_ticket is not checked whether n is the maximum size of char array > before call memcpy. > > https://www.fossil-scm.org/index.html/artifact?ln=1117-1118&name=1616c95201d38f46 For the one and only call to is_ticket(), the zUuid value has already returned true for is_valid_uuid(), so we know already that it is not over-length. That is not true for the call to in_this_repo() - it has not passwed is_valid_uuid() and might be over-length. -- D. Richard Hipp [email protected] ___ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
[fossil-users] src/wikiformat.c Is_ticket : It may be better to check the size before memcpy
src/wikiformat.c : is_ticket in_this_repo is checked whether n is maximum size of char array, https://www.fossil-scm.org/index.html/artifact?ln=1090-1092&name=1616c95201d38f46 but is_ticket is not checked whether n is the maximum size of char array before call memcpy. https://www.fossil-scm.org/index.html/artifact?ln=1117-1118&name=1616c95201d38f46___ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
