140133 - Stack overrun in nsMsgi18n.cpp

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[Mitchell Stoltz (not reading bugmail)]

http://lxr.mozilla.org/seamonkey/source/mailnews/base/util/nsMsgI18N.cpp
545   static char charset[kMAX_CSNAME+1]; 
546   char buffer[512]; 
...
580       token = nsCRT::strtok(cp, seps, &newStr); 
581       if (token != NULL) 
582       { 
583         PL_strcpy(charset, token); 
584       } 

as you may see this is a classical stack overrun.
An exploit path I have so found is the following - attach char.html to html
new html message and send it - actual result crash.
Definitely exploitable - charset is on the stack - the easiest buffer
overflow.
(gdb) frame 3
Cannot access memory at address 0x47474747
(gdb)

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch - add bounds checking and null-termination

Comment 2

[nhottanscp]

Comment on attachment 81027 [details] [diff] [review]
Patch - add bounds checking and null-termination

r=nhotta

Comment 3

[Asa Dotzler [:asa]]

Comment on attachment 81027 [details] [diff] [review]
Patch - add bounds checking and null-termination

a=asa (on behalf of drivers) for checkin to the 1.0 branch.

Comment 4

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Comment on attachment 81027 [details] [diff] [review]
Patch - add bounds checking and null-termination

sr=heikki

Comment 5

[scottputterman]

adding adt1.0.0+.  Please check this in as soon as possible after getting
drivers approval and add the fixed1.0.0 keyword.

Comment 6

[scottputterman]

Mitch, could you check this into the branch today and mark this fixed1.0.0?

Comment 7

[Mitchell Stoltz (not reading bugmail)]

Fixed, on trunk and 1.0 branch.

Comment 8

[bsharma]

Verified on 2002-04-30-trunk on WinNT.

Marking verified as per above developer comments.

Comment 9

[bsharma]

Verified on 2002-04-30-branch on WinNT.

Marking verified as per developer comments.