Menu

#302 out-of-bounds write in function DJVU::DjVuTXT::decode at DjVuText.cpp:348-20

djvulibre
closed
nobody
None
5
2021-07-09
2019-06-25
Gen
No

out-of-bounds write in function DJVU::DjVuTXT::decode at DjVuText.cpp:348-20

1 Attachments

Discussion

  • Leon Bottou

    Leon Bottou - 2019-06-28
    • status: open --> closed
     
  • Marek Kašík

    Marek Kašík - 2021-07-09

    Hi,

    I see the same crash with current upstream. The difference is that the buffer is returned by "GUTF8String::getbuf()" and not "GStringRep::getbuf()" this time.

    Since I don't see a way how to create a 0-sized string with current API of "GStringRep::UTF8" (it always returns NULL) I just check the returned buffer for NULL just before the "buffer[readsize] = 0;" in "DjVuTXT::decode()" and it does not crash.

     

Log in to post a comment.