352556 - buffer overflow for installcleanup [@ strcpy - main] regFilePath argument length isn't checked

Status: RESOLVED FIXED

(Core Graveyard :: Installer: XPInstall Engine, defect)

Description

[timeless]

I'm not going to credit coverity or klocwork or the even older tool that netscape ran whose name i can't remember or dreftool.

i actually used installcleanupunix as an interview question for a couple of years because it was a good example of bad code which let me see how people debugged simple problems (it was a real eye opener to see how people approached it), and one of the interviewees spotted this gem (there were actually a couple of other gems in this file too, i can't remember if this is the last interesting one).

installcleanup should not be running as root so nothing interesting should happen. and certainly it should never be suid.

the general program flow for installcleanup is that the old mozilla installer (which i believe isn't really used much anymore) would run it.

Comment 1

[Dan Gohman [:sunfish]]

The code containing the bugs was removed from mozilla-central in 6e65d9a3ce0f (bug 406807).