Work at SourceForge, help us to make it a better place! We have an immediate need for a Support Technician in our San Francisco or Denver office.

Close

#373 Fix: memory usage bugs in FileManager and Utf8_16_Read

open
nobody
None
5
2012-11-13
2012-05-21
Anton Vasiliev
No

This patch fixes Use After Free and Uninitialized Read errors in FileManager and Utf8_16_Read.
Solution is highly not elegant but it's much better than having UAF errors in code.

Details:
1) Use After Free bug in FileManager::loadFile () and FileManager::reloadBuffer():
First, in FileManager::loadFile () we are creating Utf8_16_Read UnicodeConvertor object. Then we are passing it into FileManager::loadFileData().
After that char data[] buffer is created inside of FileManager::loadFileData() and passed to UnicodeConvertor.convert().
Inside of UnicodeConvertor.convert(). pointer to buffer is stored to m_Buf and m_NewBuf.
When FileManager::loadFileData() is done, buffer is destroyed. m_Buf and m_NewBuf are now pointing to unallocated memory that probably still have our data (until we will allocate something).
Then we are using UnicodeConvertor.getNewBuf() and reading unallocated memory.

2) Possible read out-of-bounds bug in FileManager::getEOLFormatForm()
Since UnicodeConvertor.getNewBuf() is not considered to be NULL-terminated, we cant use strlen() on it.

3) Fixes for using unitialized variables in FileManager and Utf8_16_Read.

Tested on win7 x64.
I request other developers to test this changes.
All bugs detected with Dr. Memory tool.

Discussion

  • Anton Vasiliev
    Anton Vasiliev
    2012-05-21

    Suggested patch

     
    Attachments
  • Don HO
    Don HO
    2012-06-10

    Could any bug could be reproduced regarding this issue?

    Don

     
  • Anton Vasiliev
    Anton Vasiliev
    2012-06-10

    I don't know any way to reproduce any side effects of this bug.

    But I can explain every line changed in patch if needed.

    Also I can provide error log generated with Dr. Memory before and after applying patch (It's tricky to run Dr. Memory on npp).