139956 - Buffer overflow in plugin Post URL's (plus Fix)

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Shilad Sen]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0rc1) Gecko/20020417
BuildID:    2002041717

Bug in ParsePostBufferToFixHeaders results in a buffer overflow.

Reproducible: Always
Steps to Reproduce:
1.Call NPN_PostURL with data with a leading "\n"
2.HTTP Server gets send invalid content
3.

Actual Results:  POST Message + additional garbage received by server

Expected Results:  POST Message received by server

I've included a single line fix:

nsPluginHostImpl.cpp, line 6331; add the following:

6327       nsMemory::Free(p);
6328       *outPostData = 0;
6329       return NS_ERROR_FAILURE;
6330     }
6331     p += headersLen;
6332     newBufferLen = headersLen + dataLen; /* new line shilad */
6333   }

Comment 1

[Peter Lubczynski]

-->over to serge (maybe can add to one of the patches in progress)

Comment 2

[serge (gone)]

good finding, thanks Shilad.
your patch is in by check in for bug 130080.
resoled as fixed.

Comment 3

[shrirang khanzode]

.