3party/crashpad
0
0
Fork 0
mirror of https://github.com/chromium/crashpad.git synced 2024-12-27 15:32:10 +08:00
Code Issues Projects Releases Wiki Activity

Fix two bugs in memset()ing CrashpadInfo on size mismatch

Browse Source 
In trying to clear out the end of info when the alleged size is smaller
than the current structure size, we didn't handle the opposite case. We
need to continue the rest of Read() to initialize members, but need to
make sure not to pass a very large (negative -> size_t) length to
memset().

Additionally, I believe it meant to memset from the end of the alleged
size, to the end of the local structure, rather than from the beginning
of the structure.

This repro'd on Fuchsia, but would affect all platforms that use it.

Bug: crashpad:196, crashpad:30
Change-Id: I9c35c834010b5cb26d54156ce8f9bc538dcbf96c
Reviewed-on: https://chromium-review.googlesource.com/923094
Commit-Queue: Scott Graham <scottmg@chromium.org>
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
This commit is contained in:
Scott Graham 2018-02-15 15:58:08 -08:00 committed by Commit Bot
parent 5e5b927b38
commit eec1e17ab5
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
snapshot/crashpad_types/crashpad_info_reader.cc
View File

@ -81,7 +81,11 @@ class CrashpadInfoReader::InfoContainerSpecific : public InfoContainer {
return false;
}
memset(reinterpret_cast<char*>(&info), 0, sizeof(info) - info.size);
if (sizeof(info) > info.size) {
memset(reinterpret_cast<char*>(&info) + info.size,
0,
sizeof(info) - info.size);
}
UnsetIfNotValidTriState(&info.crashpad_handler_behavior);
UnsetIfNotValidTriState(&info.system_crash_reporter_forwarding);