Ticket #241 (closed defect: fixed)

Opened 10 years ago

Last modified 9 years ago

buffer overflow in __mhl_str_concat_hlp

Reported by: Patrick Winnertz <winnie@…> Owned by: winnie
Priority: major Milestone:
Component: mc-core Version: 4.6.2
Keywords: committed-master committed-mc-4.6 Cc:
Blocked By: Blocking:
Branch state: Votes for changeset:

Description (last modified by metux) (diff)

Hey,

There is currently a bufferoverflow in mhl_str_concat_hlp if the function is
called with more than 32 parameters.

This will fix this:

while ((a = va_arg(args, char*)) != (char*)1 && count <=31) { ... }

Attachments

0001-cleanup-mhl_str_concat-reduced-stack-usage-remo.patch (2.9 KB) - added by slyfox 10 years ago.
apply on top of 241_ branch. cleanups code a little (removes static arrays)

Change History

comment:1 Changed 10 years ago by Patrick Winnertz

  • id set to 241

This message has 0 attachment(s)

comment:2 Changed 10 years ago by Patrick Winnertz

  • Keywords review added
  • Status changed from new to accepted
  • Owner set to winnie
  • Milestone changed from 4.7 to 4.6.3

Setting myself as owner.

Please have a look into branch:241_buffer_overflow

comment:3 Changed 10 years ago by metux

  • Keywords vote-metux added
  • Description modified (diff)

Changed 10 years ago by slyfox

apply on top of 241_ branch. cleanups code a little (removes static arrays)

comment:4 Changed 10 years ago by slyfox

  • Keywords vote-slyfox approved added; review removed

comment:5 Changed 10 years ago by winnie

  • Keywords committed-master committed-mc-4.6 added

comment:6 Changed 10 years ago by metux

  • Keywords vote-metux vote-slyfox approved removed
  • Status changed from accepted to testing
  • Resolution set to fixed

comment:7 Changed 10 years ago by styx

Should be closed as useless one (no mhl for now).

comment:8 Changed 10 years ago by winnie

  • Status changed from testing to closed

comment:9 Changed 9 years ago by anonymous

  • Milestone 4.6.2.1 deleted

Milestone 4.6.2.1 deleted

Note: See TracTickets for help on using tickets.