Description:
On Windows environments, the application terminates unexpectedly due to memory corruption. This is caused by an insufficient buffer allocation size when copying the executable path string in qode_helper.cc.
Cause:
In getExecutableDir(), executablePath.length() is used to allocate the exePath buffer. However, std::string::length() does not include the null-terminator (\0). When strcpy(exePath, executablePath.c_str()) is called, it writes the null-terminator past the allocated memory boundary, resulting in a 1-byte buffer overflow (memory corruption).
This bug is located here:
|
std::string getExecutableDir() { |
|
std::string executablePath = getExecutablePath(); |
|
char* exePath = new char[executablePath.length()]; |
|
strcpy(exePath, executablePath.c_str()); |
|
PathRemoveFileSpecA(exePath); |
|
std::string directory = std::string(exePath); |
|
delete[] exePath; |
|
return directory; |
|
} |
Proposed Fix
We need to allocate executablePath.length() + 1 bytes to safely accommodate the null-terminator.
diff --git a/qode/helpers/qode_helper.cc b/qode/helpers/qode_helper.cc
index 89f357154e..e1c699fefe 100644
--- a/qode/helpers/qode_helper.cc
+++ b/qode/helpers/qode_helper.cc
@@ -44,7 +44,7 @@ std::string getExecutablePath() {
std::string getExecutableDir() {
std::string executablePath = getExecutablePath();
- char* exePath = new char[executablePath.length()];
+ char* exePath = new char[executablePath.length() + 1];
strcpy(exePath, executablePath.c_str());
PathRemoveFileSpecA(exePath);
std::string directory = std::string(exePath);
Environment:
OS: Windows
Description:
On Windows environments, the application terminates unexpectedly due to memory corruption. This is caused by an insufficient buffer allocation size when copying the executable path string in qode_helper.cc.
Cause:
In getExecutableDir(), executablePath.length() is used to allocate the exePath buffer. However, std::string::length() does not include the null-terminator (\0). When strcpy(exePath, executablePath.c_str()) is called, it writes the null-terminator past the allocated memory boundary, resulting in a 1-byte buffer overflow (memory corruption).
This bug is located here:
qodejs/qode/helpers/qode_helper.cc
Lines 45 to 53 in c611142
Proposed Fix
We need to allocate executablePath.length() + 1 bytes to safely accommodate the null-terminator.
Environment:
OS: Windows