96571 - PL_strnchr may read beyond the end of buffer if the buffer is not null-terminated

Status: RESOLVED FIXED

(NSPR :: NSPR, defect, P2)

Description

[Wan-Teh Chang]

PL_strnchr may read one byte beyond the end of buffer if
the buffer is not null-terminated.  This bug was first
reported in Browser bug 82200.  In that bug report,
Fred Roeber said:
    [PL_strnchr] should test (n && *s) and not the other
    way around.  The long if (line 77) should probably be
    similarly amended.

    Note that PL_strnrchr should be fixed too.

Comment 1

[Wan-Teh Chang]

Attachment: Proposed patch.

Comment 2

[Bradley Baetz (:bbaetz)]

*** Bug 96572 has been marked as a duplicate of this bug. ***

Comment 3

[Darin Fisher]

looks like this is problem for PL_strncasestr as well.

Comment 4

[Wan-Teh Chang]

Attachment: Revised patch.

Comment 5

[Wan-Teh Chang]

I took the opportunity to check all the PL_strn* functions.
The result is the revised patch (attachment id=49047).

I checked in the revised patch on the tip of NSPR.  You
are welcome to review the patch even though it's already
checked in.

Darin, I know you are waiting for me to fix PL_strncasestr,
but I urge you to not use any of the PL_str* functions.
These functions only work on 7-bit ASCII strings.  They may
even be incorrect for the Western European languages.  You
don't want to use these functions in an application that
needs to be internationalized.  You have been warned.

Comment 6

[Bradley Baetz (:bbaetz)]

But they are valid for http server headers which are defined to be 7 bit ASCII.