[#CORE-2437] Buffer overflow on client when delivering events.

Firebird Core

Buffer overflow on client when delivering events.

Created: 17/Apr/09 05:36 AM Updated: 08/Nov/09 10:43 PM

Component/s:

API / Client Library, Engine

Affects Version/s:

2.0.0, 1.5.4, 2.0.1, 2.0.2, 2.0.3, 1.5.5, 2.1.0, 2.0.4, 2.5 Alpha 1, 2.1.1, 2.0.5, 2.1.2, 2.5 Beta 1

Fix Version/s:

2.5 Beta 2, 2.1.3, 2.0.6

Time Tracking:

Not Specified

Issue Links:

Relate

This issue is related to:

~~CORE-2272~~ Server starts returning garbage when killing events connection attempt

Planning Status:

Unspecified

Description

« Hide

If for any reason badly formed list of events is used in isc_events_que(), it's sent to server and processed without any sanity checks (for server reads data after the end of passed buffer). As a result event with name, longer than expected, can be returned to client, passed to callback routine and cause BOF on client.

All

Comments

Work Log

Change History

Version Control

Subversion Commits

Sort Order:

[ Permalink | « Hide ]

Alexander Peshkov added a comment - 17/Apr/09 05:39 AM

Bug was found when trying to reproduce ~~CORE-2272~~

[ Permalink | « Hide ]

Alexander Peshkov added a comment - 17/Apr/09 05:48 AM

Added minimum sanity check for malformed EPB on server and check for size of received event notification on client.

[ Permalink | « Hide ]

Alexander Peshkov added a comment - 08/May/09 03:54 PM

Reopened to add backporting info