Issue 42 - nativeclient - unhandled exception occurs on line 584 of npapi_plugin/srpc/srpc_client.cc in the function MarshallInput()

Issue 42:	unhandled exception occurs on line 584 of npapi_plugin/srpc/srpc_client.cc in the function MarshallInput()
	3 people starred this issue and may be notified of changes.	Back to list

Status:	Fixed
Owner:	s...@google.com
Closed:	Apr 2009
Cc:	bradc...@google.com, s...@google.com
Security-Contest
Type-Defect

Reported by AdventureRacing, Mar 03, 2009

Team CJETM
Affected OS: OSX, Linux, Windows
Affected Browser: Firefox
******************************
 By supplying a negative integer to the getmsg() method an unhandled exception occurs on line 584 
of npapi_plugin/srpc/srpc_client.cc in the function MarshallInput(). The negative value is passed to 
the 'new' operator where it is cast as unsigned and wraps to a large number that malloc cannot 
allocate. In our POC the C++ runtime throws an exception and firefox exits. Please see attached Tar 
for Code and more Details.

	CJETM_SUBMISSION_1.tar
	2.0 KB Download

Comment 1 by nativeclient.admin, Mar 03, 2009

Verified as an issue.

Status: Accepted

Comment 2 by AdventureRacing, Mar 03, 2009

attached is a better copy of the readme in ASCII

	readm2
	3.5 KB Download

Comment 3 by chris.rohlf, Mar 03, 2009

After some thought and conversation with a friend (captain planet), if
outputs[i]->tag is type NACL_SRPC_ARG_TYPE_INT_ARRAY this issue may be exploitable
given the value 1073741824.

- Team CJETM

Comment 4 by nativeclient.admin, Mar 04, 2009

(No comment was entered for this change.)

Owner: nativeclient.admin
Cc: bradc...@google.com s...@google.com

Comment 5 by nativeclient.admin, Mar 12, 2009

(No comment was entered for this change.)

Owner: s...@google.com
Labels: Type-Defect

Comment 6 by nativeclient.admin, Apr 10, 2009

Fix was released in release 57.

Status: Fixed