Kaleidoscope

Commit Graph

Author	SHA1	Message	Date
Michael Richters	4480b08b2d	Add testcase for KeyAddrEventQueue bounds checking failure `KeyAddrEventQueue::remove()` fails to confirm that the current queue is empty before decrementing the length and shifting entries in the queue arrays. If `remove()` or `shift()` is called when the queue is empty, `length_` gets decremented from 0 to 255 (because it's unsigned), and then a large section of memory gets shifted, mostly out of bounds of the event queue arrays, and probably wreaking havoc with any number of things. The plugin in this testcase should trigger this bug, and is detectable because it affects the value for the current time. It's not guaranteed to detect this bug, but it seems to be fairly consistent. Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>	3 years ago

Author

SHA1

Message

Date

Michael Richters

4480b08b2d

Add testcase for KeyAddrEventQueue bounds checking failure

`KeyAddrEventQueue::remove()` fails to confirm that the current queue is empty
before decrementing the length and shifting entries in the queue arrays.  If
`remove()` or `shift()` is called when the queue is empty, `length_` gets
decremented from 0 to 255 (because it's unsigned), and then a large section of
memory gets shifted, mostly out of bounds of the event queue arrays, and
probably wreaking havoc with any number of things.

The plugin in this testcase should trigger this bug, and is detectable because
it affects the value for the current time.  It's not guaranteed to detect this
bug, but it seems to be fairly consistent.

Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>

1 Commits (c3ea0876c147d255611c699e75da2f4bcff41617)