139764 2014-12-17 21:43:44 -0800 buffer overflow parsing plugin information 2016-03-22 09:56:49 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Windows 7 RESOLVED INVALID P2 Normal --- 1 b.collins webkit-unassigned bfulgham oldest_to_newest 1056718 0 243481 b.collins 2014-12-17 21:43:44 -0800 Created attachment 243481 patch getVersionInfo in PluginPackageWin.cpp has a buffer overflow. VerQueryValueW returns the size of the buffer in bytes, not TCHARs for translation values 1177004 1 bfulgham 2016-03-22 09:56:49 -0700 Thank you for taking the time to report this issue, but the proposed patch is not correct. According to MSDN <https://msdn.microsoft.com/en-us/library/windows/desktop/ms647464(v=vs.85).aspx>, puLen is defined as "for version information values, the length in characters of the string stored at lplpBuffer". Since we are only retrieving version information content, not translation array or root block values, the character count is the correct size. Since we are calling the wide-character variant of VerQueryValue (VerQueryValueW), the value we get back is a buffer of UCHAR, and the count is the number of these UCHAR characters. 243481 2014-12-17 21:43:44 -0800 2016-03-22 09:43:08 -0700 patch PluginPackageWin.cpp.patch text/plain 288 b.collins ZGlmZiAtciBTb3VyY2Vfb3JpZ1xXZWJDb3JlXHBsdWdpbnNcd2luXFBsdWdpblBhY2thZ2VXaW4u Y3BwIFNvdXJjZVxXZWJDb3JlXHBsdWdpbnNcd2luXFBsdWdpblBhY2thZ2VXaW4uY3BwDQo1NmM1 Ng0KPCAgICAgcmV0dXJuIFN0cmluZyhyZWludGVycHJldF9jYXN0PFVDaGFyKj4oYnVmZmVyKSwg YnVmZmVyTGVuZ3RoIC0gMSk7DQotLS0NCj4gICAgIHJldHVybiBTdHJpbmcocmVpbnRlcnByZXRf Y2FzdDxVQ2hhcio+KGJ1ZmZlciksIChidWZmZXJMZW5ndGggLyBzaXplb2YoVUNoYXIpKSAtIDEp Ow0K