Fix segfault caused by malformed nzb files without subject #745
Conversation
|
Also... I just fixed this single uninitialised memory access that led to a crash with real world nzb data. Other structures may be affected as well, because of uninitialised strings in the structures. Someone may want to check this. |
|
Thank you. |
: for file elements not having subject attribute a (somewhat) random subject is generated and is used as file name; correct file names are read from articles later anyway
|
I've fixed this as follows: for file elements not having subject attribute an (almost) random subject is generated and is used as file name; correct file names are read from articles later during downloading. Tested with the example real nzb-files and they were downloaded successfully without issues. Thank you for reporting this and for the pull request. BTW there are no uninitialised memory or uninitialised strings. All strings are initialised with null. It's just that sometimes this special value isn't expected in certain contexts ;) The program will then always crash, which is good (for reproducing) and isn't exploitable (I hope so). |
fixes #744 and probably #741
Adding NZB files without a proper subject leads to uninitialised memory access (read & write) on non-windows systems. This may segfault or just corrupt memory.
@hugbug please consider releasing this soon. I have not examined how exploitable this actually is, but worst case this may lead to remote code execution.
Example nzb:
I haven't programmed C/C++ in 15 years, so feel free to replace the fix with something more idiomatic if you want :-)