[Helix-client-dev] CR: 259108 - crash parsing corrupt RM file

This crash was the result of not fully initializing data in the RMFFPLINLogicalStream class. We try to decode the stream header and it fails (since it's corrupt). Subsequent code then tries to access the properties associated with the stream but since the property count was only being set to a valid value if the stream loaded correctly, it contained random bogus data which resulted in trying to do a property lookup into an uninitialized array.

Index: fftypes.h
===================================================================
RCS file: /cvsroot/rarvcode-formprot/fileformat/fftypes.h,v
retrieving revision 1.5.6.1
diff -u -w -r1.5.6.1 fftypes.h
--- fftypes.h       27 Apr 2005 19:16:22 -0000           1.5.6.1
+++ fftypes.h    30 Apr 2010 21:21:47 -0000
@@ -179,9 +179,12 @@
 HX_INLINE
 RMFFPLINLogicalStream::RMFFPLINLogicalStream()
 {
+             num_physical_streams = 0;
     physical_stream_numbers = 0;
     data_offsets = 0;
+             num_rules = 0;
     rule_to_physical_stream_number_map = 0;
+             num_properties = 0;
     properties = 0;
 }

_______________________________________________
Helix-client-dev mailing list
[email protected]
http://lists.helixcommunity.org/mailman/listinfo/helix-client-dev