Menu ▾ ▴

#159 THookedObjects.Proxify reads past the end of the original class data

None
closed-fixed
None
5
1 day ago
3 days ago
No

THookedObjects.Proxify in gnugettext.pas allocates room for the class name plus the !dx suffix (dx_ChangeProxyClassname) and a trailing #0, but copied that whole size from the original class, whose ClassName is 4 bytes shorter.

So System.Move read 3 to 4 bytes past the end of the original class data and its name. If the class name ends exactly at a page or section boundary (e.g. last in a package's data), this is a read access violation; otherwise unrelated bytes are copied into the proxy. This happens even when dx_ChangeProxyClassname is not defined.

Fixed in revision 202: Proxify now copies only the original class data, up to the end of its ClassName; AllocMem has already zeroed the rest. Tested with Delphi 12, Win32 and Win64, with and without dx_ChangeProxyClassname.

Discussion

  • Thomas Mueller

    Thomas Mueller - 3 days ago

    fixed in revision [r202]

     

    Related

    Commit: [r202]

  • Thomas Mueller

    • Description has changed:

    Diff:

    
    
    • status: open --> closed-fixed
    • assigned_to: Thomas Mueller
    • Group: --> v1.0 (example)
    • Priority: --> 5
     

Log in to post a comment.