PR# 14477 Buffer overflow when printing object with long attribute name
Problem Report Summary
Submitter: prestoat2000
Category: Runtime
Priority: Medium
Date: 2008/06/16
Class: Bug
Severity: Serious
Number: 14477
Release: 6.2.73753
Confidential: No
Status: Closed
Responsible:
Environment: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.8.1.13) Gecko/20080328 Firefox/2.0.0.13
Solaris 10 on SPARC
Synopsis: Buffer overflow when printing object with long attribute name
Description
Trying to print `Current' when the current object has an attribute with a very long name (or class itself has a long name) causes a buffer overflow and a run-time panic, due to static size TAG_SIZE (currently 512) of `buffero', which isn't big enough for all cases. Either the size needs to be increased to accomodate all possible names (plus anything extra put into `buffero' by sprintf calls) or you can switch to use dynamically allocated memory and increase size when necessary.
To Reproduce
Freeze with attached classes and config file. Execute system with arguments "1 1" (1 worker, 1 iteration). System execution dies with a panic. This example is multi-threaded, but the problem exists in single-threaded systems as well (though it is easier to demonstrate with a test in an MT system).
Problem Report Interactions
This is now fixed. We never use the %s qualifier now for writing strings which is where the buffer overflow would occur. Fixed in rev#78019
Added eweasel test exec310 for this bug.