wpe-20170728: global-buffer-overflow @WTF::StringImpl::createFromLiteral() #592
Comments
|
If I'm not mistaken the problem seems to be how |
dwrobel
added a commit
to dwrobel/WPEWebKit
that referenced
this issue
Apr 10, 2019
strlen() is invoked on strings located in UserAgentStyleSheetsData.cpp, however strings in those tables doesn't not contain valid C string with '\0' character in the end. GDB callstack excerpt: (complete is available at WebPlatformForEmbedded#592) (gdb) bt (gdb) bt (gdb) fr 4 158 return createFromLiteral(characters, strlen(characters)); (gdb) l 153 return adoptRef(*new StringImpl(reinterpret_cast<const LChar*>(characters), length, ConstructWithoutCopying)); 154 } 155 156 Ref<StringImpl> StringImpl::createFromLiteral(const char* characters) 157 { 158 return createFromLiteral(characters, strlen(characters)); 159 } Signed-off-by: Damian Wrobel <dwrobel@ertelnet.rybnik.pl>
dwrobel
added a commit
to dwrobel/WPEWebKit
that referenced
this issue
Apr 10, 2019
strlen() is invoked on strings located in UserAgentStyleSheetsData.cpp, however strings in those tables doesn't not contain valid C string with '\0' character in the end. GDB callstack excerpt: (complete is available at WebPlatformForEmbedded#592) (gdb) bt (gdb) bt (gdb) fr 4 158 return createFromLiteral(characters, strlen(characters)); (gdb) l 153 return adoptRef(*new StringImpl(reinterpret_cast<const LChar*>(characters), length, ConstructWithoutCopying)); 154 } 155 156 Ref<StringImpl> StringImpl::createFromLiteral(const char* characters) 157 { 158 return createFromLiteral(characters, strlen(characters)); 159 } Signed-off-by: Damian Wrobel <dwrobel@ertelnet.rybnik.pl>
dwrobel
added a commit
to dwrobel/WPEWebKit
that referenced
this issue
Apr 10, 2019
strlen() is invoked on strings located in UserAgentStyleSheetsData.cpp, however strings in those tables doesn't not contain valid C string with '\0' character in the end. GDB callstack excerpt: (complete is available at WebPlatformForEmbedded#592) (gdb) bt #0 0x00007fb2aae415d0 in __sanitizer::Die() () at ../../../../libsanitizer/sanitizer_common/sanitizer_termination.cc:49 WebPlatformForEmbedded#1 0x00007fb2aae23ce5 in __asan::ScopedInErrorReport::~ScopedInErrorReport() (this=<optimized out>, __in_chrg=<optimized out>) at ../../../../libsanitizer/asan/asan_report.cc:181 WebPlatformForEmbedded#2 0x00007fb2aae23ce5 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) (pc=<optimized out>, bp=bp@entry=140729000272496, sp=sp@entry=140729000270360, addr=addr@entry=140405332238509, is_write=is_write@entry=false, access_size=access_size@entry=27118, exp=0, fatal=false) at ../../../../libsanitizer/asan/asan_report.cc:397 WebPlatformForEmbedded#3 0x00007fb2aadd62ac in __interceptor_strlen(char const*) (s=<optimized out>) at ../../../../libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:301 WebPlatformForEmbedded#4 0x00007fb2a95309ba in WTF::StringImpl::createFromLiteral(char const*) (characters=0x7fb2a9f376c0 <WebCore::mediaControlsBaseUserAgentStyleSheet> "audio { width: 200px; height: 25px; } body:-webkit-full-page-media { background-color: rgb(38, 38, 38); } video:-webkit-full-page-media { margin: auto; position: absolute; top: 0; right: 0; bottom: 0;"...) at ../Source/WTF/wtf/text/StringImpl.cpp:158 WebPlatformForEmbedded#5 0x00007fb2a957ff4c in WTF::String::String(WTF::ASCIILiteral) (this=0x7ffe061225d0, characters=...) at ../Source/WTF/wtf/text/WTFString.h:734 WebPlatformForEmbedded#6 0x00007fb2a4b25f21 in WebCore::RenderThemeWPE::mediaControlsStyleSheet() (this=<optimized out>) at ../Source/WTF/wtf/text/WTFString.h:733 (gdb) fr 4 158 return createFromLiteral(characters, strlen(characters)); (gdb) l 153 return adoptRef(*new StringImpl(reinterpret_cast<const LChar*>(characters), length, ConstructWithoutCopying)); 154 } 155 156 Ref<StringImpl> StringImpl::createFromLiteral(const char* characters) 157 { 158 return createFromLiteral(characters, strlen(characters)); 159 } Signed-off-by: Damian Wrobel <dwrobel@ertelnet.rybnik.pl>
dwrobel
added a commit
to dwrobel/WPEWebKit
that referenced
this issue
Apr 10, 2019
strlen() is invoked on strings located in UserAgentStyleSheetsData.cpp, however strings in those tables doesn't not contain valid C string with '\0' character in the end. GDB callstack excerpt: (complete is available at WebPlatformForEmbedded#592) (gdb) bt #0 0x00007fb2aae415d0 in __sanitizer::Die() () at ../../../../libsanitizer/sanitizer_common/sanitizer_termination.cc:49 WebPlatformForEmbedded#1 0x00007fb2aae23ce5 in __asan::ScopedInErrorReport::~ScopedInErrorReport() (this=<optimized out>, __in_chrg=<optimized out>) at ../../../../libsanitizer/asan/asan_report.cc:181 WebPlatformForEmbedded#2 0x00007fb2aae23ce5 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) (pc=<optimized out>, bp=bp@entry=140729000272496, sp=sp@entry=140729000270360, addr=addr@entry=140405332238509, is_write=is_write@entry=false, access_size=access_size@entry=27118, exp=0, fatal=false) at ../../../../libsanitizer/asan/asan_report.cc:397 WebPlatformForEmbedded#3 0x00007fb2aadd62ac in __interceptor_strlen(char const*) (s=<optimized out>) at ../../../../libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:301 WebPlatformForEmbedded#4 0x00007fb2a95309ba in WTF::StringImpl::createFromLiteral(char const*) (characters=0x7fb2a9f376c0 <WebCore::mediaControlsBaseUserAgentStyleSheet> "audio { width: 200px; height: 25px; } body:-webkit-full-page-media { background-color: rgb(38, 38, 38); } video:-webkit-full-page-media { margin: auto; position: absolute; top: 0; right: 0; bottom: 0;"...) at ../Source/WTF/wtf/text/StringImpl.cpp:158 WebPlatformForEmbedded#5 0x00007fb2a957ff4c in WTF::String::String(WTF::ASCIILiteral) (this=0x7ffe061225d0, characters=...) at ../Source/WTF/wtf/text/WTFString.h:734 WebPlatformForEmbedded#6 0x00007fb2a4b25f21 in WebCore::RenderThemeWPE::mediaControlsStyleSheet() (this=<optimized out>) at ../Source/WTF/wtf/text/WTFString.h:733 (gdb) fr 4 158 return createFromLiteral(characters, strlen(characters)); (gdb) l 153 return adoptRef(*new StringImpl(reinterpret_cast<const LChar*>(characters), length, ConstructWithoutCopying)); 154 } 155 156 Ref<StringImpl> StringImpl::createFromLiteral(const char* characters) 157 { 158 return createFromLiteral(characters, strlen(characters)); 159 } Signed-off-by: Damian Wrobel <dwrobel@ertelnet.rybnik.pl>
dwrobel
added a commit
to dwrobel/WPEWebKit
that referenced
this issue
Apr 23, 2019
strlen() is invoked on strings located in UserAgentStyleSheetsData.cpp, however strings in those tables doesn't not contain valid C string with '\0' character in the end. GDB callstack excerpt: (complete is available at WebPlatformForEmbedded#592) (gdb) bt #0 0x00007fb2aae415d0 in __sanitizer::Die() () at ../../../../libsanitizer/sanitizer_common/sanitizer_termination.cc:49 WebPlatformForEmbedded#1 0x00007fb2aae23ce5 in __asan::ScopedInErrorReport::~ScopedInErrorReport() (this=<optimized out>, __in_chrg=<optimized out>) at ../../../../libsanitizer/asan/asan_report.cc:181 WebPlatformForEmbedded#2 0x00007fb2aae23ce5 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) (pc=<optimized out>, bp=bp@entry=140729000272496, sp=sp@entry=140729000270360, addr=addr@entry=140405332238509, is_write=is_write@entry=false, access_size=access_size@entry=27118, exp=0, fatal=false) at ../../../../libsanitizer/asan/asan_report.cc:397 WebPlatformForEmbedded#3 0x00007fb2aadd62ac in __interceptor_strlen(char const*) (s=<optimized out>) at ../../../../libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:301 WebPlatformForEmbedded#4 0x00007fb2a95309ba in WTF::StringImpl::createFromLiteral(char const*) (characters=0x7fb2a9f376c0 <WebCore::mediaControlsBaseUserAgentStyleSheet> "audio { width: 200px; height: 25px; } body:-webkit-full-page-media { background-color: rgb(38, 38, 38); } video:-webkit-full-page-media { margin: auto; position: absolute; top: 0; right: 0; bottom: 0;"...) at ../Source/WTF/wtf/text/StringImpl.cpp:158 WebPlatformForEmbedded#5 0x00007fb2a957ff4c in WTF::String::String(WTF::ASCIILiteral) (this=0x7ffe061225d0, characters=...) at ../Source/WTF/wtf/text/WTFString.h:734 WebPlatformForEmbedded#6 0x00007fb2a4b25f21 in WebCore::RenderThemeWPE::mediaControlsStyleSheet() (this=<optimized out>) at ../Source/WTF/wtf/text/WTFString.h:733 (gdb) fr 4 158 return createFromLiteral(characters, strlen(characters)); (gdb) l 153 return adoptRef(*new StringImpl(reinterpret_cast<const LChar*>(characters), length, ConstructWithoutCopying)); 154 } 155 156 Ref<StringImpl> StringImpl::createFromLiteral(const char* characters) 157 { 158 return createFromLiteral(characters, strlen(characters)); 159 } Signed-off-by: Damian Wrobel <dwrobel@ertelnet.rybnik.pl>
|
Inactive ticket for long time! Closing the ticket; if you think it is still relevant and/or valid for the latest version/s. Please do not hesitate to re-open! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
GDB callstack:
The text was updated successfully, but these errors were encountered: