Bug Submission
"Jeremy Dickman" <[email protected]> Mon, 20 Nov 2006 13:36:16 -0000
| Newsgroups | gmane.comp.gcc.cgicc.bugs |
|---|---|
| Message-ID | <9ECD38DDDB17D944BAABE57A572DD1950F0222@wimb-serv-01.cohagencapital.com> |
This is a multi-part message in MIME format.
--===============1357954152==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C70CA8.DA66294A"
This is a multi-part message in MIME format.
------_=_NextPart_001_01C70CA8.DA66294A
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sir / Madam
=20
I believe I have come across a bug in cgicc-3.2.3.
=20
In file CgiEnvironment.cpp, lines 77, 81 & 85, there is some code using
&data[0] where data was previously defined as a vector of char's, who's
size is initialised with getContentLength(). If that function returns 0
then the code at lines 77, 81 & 85 crashes because it's trying to
reference item 0 of the vector when the vector itself is empty.
=20
Thus, when getContentLength() returns 0, these lines (indicated in red
below) cause a crash
=20
// Don't use auto_ptr, but vector instead
// Bug reported by [email protected]
std::vector<char> data(getContentLength());
=20
// If input is 0, use the default implementation of CgiInput
if(input =3D=3D 0) {
if(local_input.read(&data[0],getContentLength()) !=3D
getContentLength()) <-- *** Crash!
throw std::runtime_error("I/O error");
}
else {
if(input->read(&data[0], getContentLength()) !=3D
getContentLength()) <-- *** Crash!
throw std::runtime_error("I/O error");
}
=20
fPostData =3D std::string(&data[0], getContentLength()); <-- ***
Crash!
=20
=20
This crash occurred on my Windows system. I had a web page that called
"submit" on my CGI script programmatically, without sending any form
data. Thus, the CGI content was empty, which explains why
getContentLength returned 0.
=20
Hope this helps?
=20
By the way, cgicc is an excellent package and I've found it very useful
and easy to use. Keep up the good work.
=20
Regards
=20
Jeremy C Dickman
=20
------_=_NextPart_001_01C70CA8.DA66294A
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 10 (filtered)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=3DEN-GB link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Sir / Madam</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>I believe I have come across a bug in =
cgicc-3.2.3.</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>In file CgiEnvironment.cpp, lines 77, 81 & 85, =
there is
some code using &data[0] where data was previously defined as a =
vector of
char’s, who’s size is initialised with getContentLength(). =
If that
function returns 0 then the code at lines 77, 81 & 85 crashes =
because it’s
trying to reference item 0 of the vector when the vector itself is =
empty.</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Thus, when getContentLength() returns 0, these lines =
(indicated
in red below) cause a crash</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
<font
color=3Dgreen><span style=3D'color:green'>// Don't use auto_ptr, but =
vector instead</span></font></span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
<font
color=3Dgreen><span style=3D'color:green'>// Bug reported by =
[email protected]</span></font></span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
std::vector<<font
color=3Dblue><span style=3D'color:blue'>char</span></font>> =
data(getContentLength());</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
<font
color=3Dgreen><span style=3D'color:green'>// If input is 0, use the =
default
implementation of CgiInput</span></font></span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
<font
color=3Dblue><span style=3D'color:blue'>if</span></font>(input =3D=3D 0) =
{</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier =
New"'>
<font color=3Dblue><span =
style=3D'color:blue'>if</span></font>(local_input.read(&data[0],getCo=
ntentLength())
!=3D getContentLength()) </span></font><font size=3D1 =
color=3Dred
face=3DWingdings><span =
style=3D'font-size:9.0pt;font-family:Wingdings;color:red'>ß</span><=
/font><font
size=3D1 color=3Dred face=3D"Courier New"><span =
style=3D'font-size:9.0pt;font-family:
"Courier New";color:red'> *** Crash!</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier =
New"'> <font
color=3Dblue><span style=3D'color:blue'>throw</span></font> =
std::runtime_error(<font
color=3Dred><span style=3D'color:red'>"I/O =
error"</span></font>);</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
}</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
<font
color=3Dblue><span style=3D'color:blue'>else</span></font> =
{</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier =
New"'>
<font color=3Dblue><span =
style=3D'color:blue'>if</span></font>(input->read(&data[0],
getContentLength()) !=3D getContentLength()) =
</span></font><font
size=3D1 color=3Dred face=3DWingdings><span =
style=3D'font-size:9.0pt;font-family:Wingdings;
color:red'>ß</span></font><font size=3D1 color=3Dred =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New";color:red'> *** =
Crash!</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier =
New"'> <font
color=3Dblue><span style=3D'color:blue'>throw</span></font> =
std::runtime_error(<font
color=3Dred><span style=3D'color:red'>"I/O =
error"</span></font>);</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
}</span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier =
New"'> </span></font></p>
<p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D1 =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New"'> =
fPostData
=3D std::string(&data[0], getContentLength()); =
</span></font><font
size=3D1 color=3Dred face=3DWingdings><span =
style=3D'font-size:9.0pt;font-family:Wingdings;
color:red'>ß</span></font><font size=3D1 color=3Dred =
face=3D"Courier New"><span
style=3D'font-size:9.0pt;font-family:"Courier New";color:red'> *** =
Crash!</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>This crash occurred on my Windows system. I had a web =
page
that called “submit” on my CGI script programmatically, =
without
sending any form data. Thus, the CGI content was empty, which explains =
why getContentLength
returned 0.</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Hope this helps?</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>By the way, cgicc is an excellent package and =
I’ve
found it very useful and easy to use. Keep up the good =
work.</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Regards</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Jeremy C Dickman</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
</div>
</body>
</html>
------_=_NextPart_001_01C70CA8.DA66294A--
--===============1357954152==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
bug-cgicc mailing list
[email protected]
http://lists.gnu.org/mailman/listinfo/bug-cgicc
--===============1357954152==--