| Summary: | buffer overflow parsing plugin information | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Bevan Collins <b.collins> | ||||
| Component: | WebCore Misc. | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | RESOLVED INVALID | ||||||
| Severity: | Normal | CC: | bfulgham | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Windows 7 | ||||||
| Attachments: |
|
||||||
Thank you for taking the time to report this issue, but the proposed patch is not correct. According to MSDN <https://msdn.microsoft.com/en-us/library/windows/desktop/ms647464(v=vs.85).aspx>, puLen is defined as "for version information values, the length in characters of the string stored at lplpBuffer". Since we are only retrieving version information content, not translation array or root block values, the character count is the correct size. Since we are calling the wide-character variant of VerQueryValue (VerQueryValueW), the value we get back is a buffer of UCHAR, and the count is the number of these UCHAR characters. |
Created attachment 243481 [details] patch getVersionInfo in PluginPackageWin.cpp has a buffer overflow. VerQueryValueW returns the size of the buffer in bytes, not TCHARs for translation values