Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(418)

Issue 2027007: Fix a crash in IP address checking because the boundary case for an empty or ... (Closed)

Created:
10 years, 7 months ago by brettw
Modified:
9 years, 7 months ago
CC:
chromium-reviews
Visibility:
Public.

Description

Fix a crash in IP address checking because the boundary case for an empty or invalid IP address isn't handled correctly and we can go reading random memory. This doesn't happen during normal host canonicalization because it won't try to canonicalize the IP address of an empty host. It only happens if the app is trying to see if a previously-canonicalized URL is an IP. BUG=http://code.google.com/p/chromium/issues/detail?id=43819 TEST=none. I wrote a simple unit tests but it doesn't actually work to catch this case. I could not figure out how to get the old code to fail reproducibly, since it starts reading random memory until it finds a character that's invalid. Normally this happens quickly so the crash doesn't occur. It only happens if all characters in memory following the string are valid IP address characters. Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=134

Patch Set 1 #

Total comments: 1
Unified diffs Side-by-side diffs Delta from patch set Stats (+22 lines, -3 lines) Patch
M src/url_canon_ip.cc View 2 chunks +5 lines, -2 lines 1 comment Download
M src/url_canon_unittest.cc View 1 chunk +17 lines, -1 line 0 comments Download

Messages

Total messages: 3 (0 generated)
brettw
10 years, 7 months ago (2010-05-11 17:59:19 UTC) #1
abarth-chromium
Ok. I haven't looked at this code in detail yet (I've been focusing on the ...
10 years, 7 months ago (2010-05-11 18:28:44 UTC) #2
Peter Kasting
10 years, 7 months ago (2010-05-11 18:34:33 UTC) #3
http://codereview.chromium.org/2027007/diff/1/2
File src/url_canon_ip.cc (right):

http://codereview.chromium.org/2027007/diff/1/2#newcode82
src/url_canon_ip.cc:82: if (component_len == 0 && (i != end || cur_component ==
1))
You should change "i != end" to "i < end" here.

Powered by Google App Engine
This is Rietveld 408576698