[hylafax-devel] Fwd: Re: Re: Another case of Assertion failed "Invalid Str[] index"

[Aidan Van Dyk <aidan@highrise.ca>]

On 29 Jun, Darren Nickerson wrote:
> 
> 
> Thoughts?


faxd/NSF.c++

void NSF::decode()
{
    for( const NSFData* p = KnownNSF; p->vendorId; p++ ){
*****   if( !memcmp( p->vendorId, &nsf[0], p->vendorIdSize ) ){
            if (p->vendorName != 0) {
                vendor = p->vendorName;
            } if( p->knownModels ){
                for( const ModelData* pp = p->knownModels; pp->modelId; pp++ )
*****              if( !memcmp( pp->modelId, &nsf[p->modelIdPos], p->modelIdSize ) )
                        model = pp->modelName;
            } findStationId( p->inverseStationIdOrder ); vendorDecoded =
            true;
        }
    } if( !vendorFound() )
       findStationId( 0 );
}

Unbounded access to fxStr nsf...


The NSF char* being parsed as read was:
"+FNF:\255\0B00               \r\n"

So, loadHexData would have left nsf be an empty fxStr (\255 is not valid hex
digit), and consquently, in decode(), the nsf[0] is out of bounds.

Patch:
--- faxd/NSF.c++.orig   Thu Jun 29 16:37:55 2000
+++ faxd/NSF.c++        Thu Jun 29 16:49:14 2000
@@ -144,6 +144,8 @@
 
 void NSF::decode()
 {
+    if ( nsf.length() == 0 )
+        return;
     for( const NSFData* p = KnownNSF; p->vendorId; p++ ){
         if( !memcmp( p->vendorId, &nsf[0], p->vendorIdSize ) ){
             if (p->vendorName != 0) {



It runs on mine...  But I wasn't getting that bad NSF data.

a.
-- 
Aidan Van Dyk                                        Create like a god,
aidan@highrise.ca                                  command like a king,
http://www.highrise.ca/                              work like a slave.

   |\^/|       |\^/|       |\^/|       |\^/|       |\^/|       |\^/|
_|\|   |/|_ _|\|   |/|_ _|\|   |/|_ _|\|   |/|_ _|\|   |/|_ _|\|   |/|_
>    C    < >    a    < >    n    < >    a    < >    d    < >    a    <
 >_./|\._<   >_./|\._<   >_./|\._<   >_./|\._<   >_./|\._<   >_./|\._<




____________________ HylaFAX(tm) Developers Mailing List ____________________
 To unsub: mail -s unsubscribe hylafax-devel-request@hylafax.org < /dev/null