Bug 108115 - Merging registry modules can overflow
Summary: Merging registry modules can overflow
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-26 12:16 UTC by Chris Sherlock
Modified: 2024-11-09 13:25 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Sherlock 2017-05-26 12:16:44 UTC
In the registry module, if you have two sets of registry "modules" (keys and subkeys) then you can potentially cause an overflow condition in ORegistry::mergeModuleValue().

That's because a RegistryTypeWriter has a capacity of (2^16 - 1), but when this function merges there can potentially be more than (2^16 - 1) values it tries to insert.

We need to either insert check that the total number of values to be inserted aren't going to be more than (2^16 -1) and give RegError::NO_ERROR, or we need to insert the original values, then insert the rest of the values and return a new error value RegError::PARTIAL_MERGE

I favour the latter, as we are sort of doing this already in the code, only we don't warn it is a partial merge.
Comment 1 Xisco Faulí 2017-05-26 15:00:20 UTC
I trust you, moving to NEW ;-)
Comment 2 Chris Sherlock 2017-06-08 02:35:55 UTC
I have submitted a change to gerrit for review - https://gerrit.libreoffice.org/#/c/38071/

I've added Stefan Bergmann and Michael Meeks to the code review.
Comment 3 Xisco Faulí 2017-10-12 08:09:49 UTC
Dear Chris Sherlock,
This bug has been in ASSIGNED status for more than 3 months without any
activity. Resetting it to NEW.
Please assigned it back to yourself if you're still working on this.
Comment 4 QA Administrators 2018-10-13 03:14:09 UTC Comment hidden (obsolete)
Comment 5 QA Administrators 2020-10-13 04:47:10 UTC Comment hidden (obsolete)
Comment 6 QA Administrators 2022-10-14 03:32:58 UTC Comment hidden (obsolete)
Comment 7 QA Administrators 2024-10-14 03:13:40 UTC Comment hidden (obsolete)
Comment 8 Chris Sherlock 2024-11-09 13:25:35 UTC
This is no longer an issue as the function in question no longer exists.