[Libreoffice-commits] online.git: fuzzer/data wsd/ClientSession.cpp

[Miklos Vajna (via logerrit)]

 fuzzer/data/crash-2dc9a83fb2861cecefd31e65064639d1ce118bd3 |binary
 wsd/ClientSession.cpp                                      |    2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit d129979822212f739279de89c9f6ad5d48f338f4
Author:     Miklos Vajna <vmiklos at collabora.com>
AuthorDate: Thu Feb 27 15:34:52 2020 +0100
Commit:     Miklos Vajna <vmiklos at collabora.com>
CommitDate: Thu Feb 27 17:59:59 2020 +0100

    wsd: fix crash with read-only documents + uno command without param
    
    ==15956==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000007cd2f7 bp 0x7ffe96c7cd70 sp 0x7ffe96c7c4e8 T0)
    ...
        #7 0x11a9d31 in ClientSession::filterMessage(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const wsd/ClientSession.cpp:977:27
        #8 0x11925d6 in ClientSession::_handleInput(char const*, int) wsd/ClientSession.cpp:741:14
        #9 0x19395d0 in Session::handleMessage(bool, WSOpCode, std::vector<char, std::allocator<char> >&) common/Session.cpp:230:13
    
    This seems to be a recurring pattern, I'll consider reworking
    LOOLProtocol::tokenize() in a follow-up commit to have a return value
    that is safer than std::vector<std::string>.
    
    Change-Id: I0e71214a55af2e71e4787cb0dba0ddf7825bf9d9
    Reviewed-on: https://gerrit.libreoffice.org/c/online/+/89637
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice at gmail.com>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.com>

diff --git a/fuzzer/data/crash-2dc9a83fb2861cecefd31e65064639d1ce118bd3 b/fuzzer/data/crash-2dc9a83fb2861cecefd31e65064639d1ce118bd3
new file mode 100644
index 000000000..39175f20c
Binary files /dev/null and b/fuzzer/data/crash-2dc9a83fb2861cecefd31e65064639d1ce118bd3 differ
diff --git a/wsd/ClientSession.cpp b/wsd/ClientSession.cpp
index 1c9ac7e66..75106c162 100644
--- a/wsd/ClientSession.cpp
+++ b/wsd/ClientSession.cpp
@@ -974,7 +974,7 @@ bool ClientSession::filterMessage(const std::string& message) const
         }
         else if (tokens[0] == "uno")
         {
-            if (tokens[1] == ".uno:ExecuteSearch")
+            if (tokens.size() > 1 && tokens[1] == ".uno:ExecuteSearch")
             {
                 allowed = true;
             }