
|
If you were logged in you would be able to see more operations.
|
|
|
|
Environment:
|
Platform independent.
|
|
| Planning Status: |
Unspecified
|
|
In FB1, I noticed that INF_put_item may put the requested item but without leaving any space for isc_info_end and thus returning a malformed buffer to the user, that may eventually crash while finding the end of the binary string. Hence, I made INF_put_item check for one byte more of space before writing, otherwise putting isc_info_truncated and nothing more. This change avoided cluttering the code in the INF_* functions with checks and it worked well in FB1.0, FB1.5 and FB2.0.
However, in FB2.1, Vlad added isc_info_length as an initial item to inform the user of the output's total length. For this task, once the buffer is filled, he shifts it to make room for 7 bytes at the beginning and calls INF_put_item. However, this function is unaware that it's inserting (isc_info_end is already stored) and if only 7 bytes are available in the buffer, it will fail, writing isc_info_truncated at the very beginning, effectively invalidating all the information stored in the output buffer. This is a boundary case and didn't find it in practice but by reading the code. The affected functions are those where Vlad made the enhancement: INF_blob_info, INF_request_info and INF_transaction_info. INF_database_info isn't affected because it was left unchanged by Vlad.
|
|
Description
|
In FB1, I noticed that INF_put_item may put the requested item but without leaving any space for isc_info_end and thus returning a malformed buffer to the user, that may eventually crash while finding the end of the binary string. Hence, I made INF_put_item check for one byte more of space before writing, otherwise putting isc_info_truncated and nothing more. This change avoided cluttering the code in the INF_* functions with checks and it worked well in FB1.0, FB1.5 and FB2.0.
However, in FB2.1, Vlad added isc_info_length as an initial item to inform the user of the output's total length. For this task, once the buffer is filled, he shifts it to make room for 7 bytes at the beginning and calls INF_put_item. However, this function is unaware that it's inserting (isc_info_end is already stored) and if only 7 bytes are available in the buffer, it will fail, writing isc_info_truncated at the very beginning, effectively invalidating all the information stored in the output buffer. This is a boundary case and didn't find it in practice but by reading the code. The affected functions are those where Vlad made the enhancement: INF_blob_info, INF_request_info and INF_transaction_info. INF_database_info isn't affected because it was left unchanged by Vlad. |
Show » |
| The cvs commits can not be displayed for repository Firebird at the moment since the log has not yet been parsed. The log will be parsed the next time the VcsService runs. If you have administrators privileges you can hasten the next time the service will run in the service section of the Administration pages.
|
|