Skip to content

urlmon: Fix out-of-bound access when trying to remove dot segments from URI.

Yuxuan Shui requested to merge yshui/wine:urlmon-canon-oob into master

Dot segments removal in parse_canonicalize makes the assumption that the entire path part of the URI fits into the output buffer (len is the length the output URI would have taken had the output buffer been large enough). So when the output buffer is too small, remove_dot_segments will access out-of-bound.

Considering URI unescaping could be happening at the same time, there is no simple way to calculate the required output buffer size correctly without keeping the actual output URI in memory.


As you can see from the test results, this seems to be bugged on native. I don't know if we need to replicate native's behavior

Merge request reports

Loading