Menu

#1665 Server crashes writing to clipboard if GlobalLock fails (2.8.87)

open
nobody
5
24 hours ago
24 hours ago
No

WindowsClipboard::writeToClipBoard() (desktop/WindowsClipboard.cpp:57-58)
does not check GlobalLock() return value before passing it to memcpy():

TCHAR *buff = (TCHAR *)GlobalLock(hglb);
memcpy(buff, clipboard.getString(), clipSize);

GlobalAlloc() is checked for NULL two lines earlier. GlobalLock() is not.
Windows docs state GlobalLock can return NULL on failure. NULL dest in
memcpy() crashes the server.

Attached PoC: GlobalFree + GlobalLock on freed handle returns NULL;
write to address 0x1 (null-access zone) exits STATUS_ACCESS_VIOLATION
(0xC0000005).

Fix: check buff != NULL before memcpy.
Version: 2.8.87.

Discussion


Log in to post a comment.

MongoDB Logo MongoDB