134351 2014-06-26 10:44:41 -0700 [Win] Fix potential buffer overrun in DLLLauncher 2014-06-26 17:04:26 -0700 1 1 1 Unclassified WebKit Tools / Tests 528+ (Nightly build) PC All RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham bfulgham bunhere cdumez commit-queue ddkilzer gyuyoung.kim sergio oldest_to_newest 1018671 0 bfulgham 2014-06-26 10:44:41 -0700 Correct a possible buffer overrun in the DLLLauncher utility. 1018672 1 bfulgham 2014-06-26 10:45:02 -0700 <rdar://problem/17469185> 1018675 2 233914 bfulgham 2014-06-26 10:46:41 -0700 Created attachment 233914 Patch 1018676 3 233915 bfulgham 2014-06-26 10:47:19 -0700 Created attachment 233915 Patch 1018691 4 233915 darin 2014-06-26 11:41:15 -0700 Comment on attachment 233915 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=233915&action=review > Tools/win/DLLLauncher/DLLLauncherMain.cpp:177 > if (len >= bufSize) > - len = bufSize - 1; > + len = bufSize - 2; This change looks wrong. > Tools/win/DLLLauncher/DLLLauncherMain.cpp:179 > errorMessage[len + 1] = 0; This is the line of code that seems to have a bug. It should say errorMessage[len] = '\0'; 1018802 5 233915 bfulgham 2014-06-26 16:54:17 -0700 Comment on attachment 233915 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=233915&action=review >> Tools/win/DLLLauncher/DLLLauncherMain.cpp:179 >> errorMessage[len + 1] = 0; > > This is the line of code that seems to have a bug. It should say errorMessage[len] = '\0'; You are right. I just read the documents on FormatMessage, and it returns the number of characters NOT including null. So len + 1 was always wrong, as it gave at least one wchar_t's worth of garbage at the end of the line. 1018803 6 233946 bfulgham 2014-06-26 16:55:59 -0700 Created attachment 233946 Patch 1018806 7 bfulgham 2014-06-26 17:04:26 -0700 Committed r170510: <http://trac.webkit.org/changeset/170510> 233914 2014-06-26 10:46:41 -0700 2014-06-26 10:47:17 -0700 Patch bug-134351-20140626104627.patch text/plain 1160 bfulgham SW5kZXg6IFRvb2xzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9DaGFuZ2VMb2cJKHJl dmlzaW9uIDE3MDQ4MykKKysrIFRvb2xzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwz ICsxLDE0IEBACisyMDE0LTA2LTI2ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29t PgorCisgICAgICAgIFtXaW5dIEZpeCBwb3RlbnRpYWwgYnVmZmVyIG92ZXJydW4gaW4gRExMTGF1 bmNoZXIKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEz NDM1MQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMTc0NjkxODU+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB3aW4vRExMTGF1bmNoZXIvRExMTGF1 bmNoZXJNYWluLmNwcDogQ29ycmVjdCBlcnJvcgorICAgICAgICBpbiBlbmQtb2YtYnVmZmVyIGNh bGN1bGF0aW9uLgorCiAyMDE0LTA2LTI1ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUu Y29tPgogCiAgICAgICAgIFtXaW5dIEV4cG9zZSBDYWNoZSBJbmZvcm1hdGlvbiB0byBXaW5MYXVu Y2hlcgpJbmRleDogVG9vbHMvd2luL0RMTExhdW5jaGVyL0RMTExhdW5jaGVyTWFpbi5jcHAKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gVG9vbHMvd2luL0RMTExhdW5jaGVyL0RMTExhdW5jaGVyTWFpbi5jcHAJKHJl dmlzaW9uIDE3MDQ4MikKKysrIFRvb2xzL3dpbi9ETExMYXVuY2hlci9ETExMYXVuY2hlck1haW4u Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xLDUgKzEsNSBAQAogLyoKLSAqIENvcHlyaWdodCAoQykg MjAxMi0yMDEzIEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAqIENvcHlyaWdodCAo QykgMjAxMi0yMDE0IEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KICAqCiAgKiBSZWRp c3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdp dGhvdXQKICAqIG1vZGlmaWNhdGlvbiwgYXJlIHBlcm1pdHRlZCBwcm92aWRlZCB0aGF0IHRoZSBm b2xsb3dpbmcgY29uZGl0aW9ucwo= 233915 2014-06-26 10:47:19 -0700 2014-06-26 16:55:55 -0700 Patch bug-134351-20140626104705.patch text/plain 1453 bfulgham SW5kZXg6IFRvb2xzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9DaGFuZ2VMb2cJKHJl dmlzaW9uIDE3MDQ4MykKKysrIFRvb2xzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwz ICsxLDE0IEBACisyMDE0LTA2LTI2ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29t PgorCisgICAgICAgIFtXaW5dIEZpeCBwb3RlbnRpYWwgYnVmZmVyIG92ZXJydW4gaW4gRExMTGF1 bmNoZXIKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEz NDM1MQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMTc0NjkxODU+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB3aW4vRExMTGF1bmNoZXIvRExMTGF1 bmNoZXJNYWluLmNwcDogQ29ycmVjdCBlcnJvcgorICAgICAgICBpbiBlbmQtb2YtYnVmZmVyIGNh bGN1bGF0aW9uLgorCiAyMDE0LTA2LTI1ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUu Y29tPgogCiAgICAgICAgIFtXaW5dIEV4cG9zZSBDYWNoZSBJbmZvcm1hdGlvbiB0byBXaW5MYXVu Y2hlcgpJbmRleDogVG9vbHMvd2luL0RMTExhdW5jaGVyL0RMTExhdW5jaGVyTWFpbi5jcHAKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gVG9vbHMvd2luL0RMTExhdW5jaGVyL0RMTExhdW5jaGVyTWFpbi5jcHAJKHJl dmlzaW9uIDE3MDQ4MikKKysrIFRvb2xzL3dpbi9ETExMYXVuY2hlci9ETExMYXVuY2hlck1haW4u Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xLDUgKzEsNSBAQAogLyoKLSAqIENvcHlyaWdodCAoQykg MjAxMi0yMDEzIEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAqIENvcHlyaWdodCAo QykgMjAxMi0yMDE0IEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KICAqCiAgKiBSZWRp c3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdp dGhvdXQKICAqIG1vZGlmaWNhdGlvbiwgYXJlIHBlcm1pdHRlZCBwcm92aWRlZCB0aGF0IHRoZSBm b2xsb3dpbmcgY29uZGl0aW9ucwpAQCAtMTc0LDcgKzE3NCw3IEBAIHN0YXRpYyB3c3RyaW5nIGdl dExhc3RFcnJvclN0cmluZyhIUkVTVUwKICAgICB3Y2hhcl90IGVycm9yTWVzc2FnZVtidWZTaXpl XTsKICAgICBEV09SRCBsZW4gPSA6OkZvcm1hdE1lc3NhZ2VXKGtGbGFncywgMCwgaHIsIDAsIGVy cm9yTWVzc2FnZSwgYnVmU2l6ZSwgMCk7CiAgICAgaWYgKGxlbiA+PSBidWZTaXplKQotICAgICAg ICBsZW4gPSBidWZTaXplIC0gMTsKKyAgICAgICAgbGVuID0gYnVmU2l6ZSAtIDI7CiAKICAgICBl cnJvck1lc3NhZ2VbbGVuICsgMV0gPSAwOwogCg== 233946 2014-06-26 16:55:59 -0700 2014-06-26 16:56:42 -0700 Patch bug-134351-20140626165621.patch text/plain 1367 bfulgham SW5kZXg6IFRvb2xzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9DaGFuZ2VMb2cJKHJl dmlzaW9uIDE3MDQ4MykKKysrIFRvb2xzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwz ICsxLDE0IEBACisyMDE0LTA2LTI2ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29t PgorCisgICAgICAgIFtXaW5dIEZpeCBwb3RlbnRpYWwgYnVmZmVyIG92ZXJydW4gaW4gRExMTGF1 bmNoZXIKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEz NDM1MQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMTc0NjkxODU+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB3aW4vRExMTGF1bmNoZXIvRExMTGF1 bmNoZXJNYWluLmNwcDogQ29ycmVjdCBlcnJvcgorICAgICAgICBpbiBlbmQtb2YtYnVmZmVyIGNh bGN1bGF0aW9uLgorCiAyMDE0LTA2LTI1ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUu Y29tPgogCiAgICAgICAgIFtXaW5dIEV4cG9zZSBDYWNoZSBJbmZvcm1hdGlvbiB0byBXaW5MYXVu Y2hlcgpJbmRleDogVG9vbHMvd2luL0RMTExhdW5jaGVyL0RMTExhdW5jaGVyTWFpbi5jcHAKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gVG9vbHMvd2luL0RMTExhdW5jaGVyL0RMTExhdW5jaGVyTWFpbi5jcHAJKHJl dmlzaW9uIDE3MDQ4MikKKysrIFRvb2xzL3dpbi9ETExMYXVuY2hlci9ETExMYXVuY2hlck1haW4u Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xLDUgKzEsNSBAQAogLyoKLSAqIENvcHlyaWdodCAoQykg MjAxMi0yMDEzIEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAqIENvcHlyaWdodCAo QykgMjAxMi0yMDE0IEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KICAqCiAgKiBSZWRp c3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdp dGhvdXQKICAqIG1vZGlmaWNhdGlvbiwgYXJlIHBlcm1pdHRlZCBwcm92aWRlZCB0aGF0IHRoZSBm b2xsb3dpbmcgY29uZGl0aW9ucwpAQCAtMTc2LDcgKzE3Niw3IEBAIHN0YXRpYyB3c3RyaW5nIGdl dExhc3RFcnJvclN0cmluZyhIUkVTVUwKICAgICBpZiAobGVuID49IGJ1ZlNpemUpCiAgICAgICAg IGxlbiA9IGJ1ZlNpemUgLSAxOwogCi0gICAgZXJyb3JNZXNzYWdlW2xlbiArIDFdID0gMDsKKyAg ICBlcnJvck1lc3NhZ2VbbGVuXSA9IDA7CiAKICAgICByZXR1cm4gZXJyb3JNZXNzYWdlOwogfQo=