#934 Buffer overflow in the way project files are processed

[Vilius Povilaika]

To replicate the buffer overflow:
1. Create a new CBP project
2. Close the project, open the .cbp file with a text editor
3. Find the object_output setting in the Debug configuration
4. Replace the value with 6 thousand characters
5. Load the file into Code::Blocks IDE
6. Press 'Build and Run'
7. Watch your program crash

[Vilius Povilaika]

Detailed instructions on replication can be found here:
https://www.povonsec.com/codeblocks-security-vulnerability/

[John Helmert III]

Hi, why was this closed as invalid? I can definitely reproduce (despite the relatively poor report).

[ollydbg]

The report has some issue:
1, "6 thousand characters"???
2, we web address is broken, I can't access it.

[John Helmert III]

Yes, excessive input is a typical way to produce a buffer overflow.

[Andrew Cottrell]

The app crashed due to user doing crazy things.

If you can show that there is a security issue then it can be looked at, but if you want to get it fixed then patches are welcome that stop the crash for crazy/stupid/dumb end users.

Just because you overflowed something does NOT mean there is a security issue.