Actions
Bug #12374
closed
MV
MV
Resolve an overflow with the Boost spirit grammar implementation for message resource plurals
Bug #12374:
Resolve an overflow with the Boost spirit grammar implementation for message resource plurals
Start date:
01/31/2024
Due date:
% Done:
0%
Estimated time:
Description
The string that is added as the parameter for WMessageResource::resolvePluralKey, is evaluated by a grammar written with Boost spirit.
This lead to an issue noticed by OSS-Fuzz. While this is not a reasonable attack vector, it can potentially lead to crashes if a developer makes a mistake. While this mistake is likely to be noticed during development, there is a possibility of a typo causing side-effects that should not happen.
There is the potential of a stackoverflow here, when Boost spirit is allowed to recursively keep going without a depth limitation.
MV Updated by Matthias Van Ceulebroeck over 2 years ago
- Related to Bug #12352: Resolve an issue with the Boost spirit grammar implementation for message resource plurals added
YG Updated by Yoika Ghysens over 2 years ago
- Status changed from InProgress to Review
- Assignee changed from Matthias Van Ceulebroeck to Yoika Ghysens
MV Updated by Matthias Van Ceulebroeck over 2 years ago
- Related to Improvements #12384: Make the Boost::spirit parser for WMessageResources plurals more robust added
MV Updated by Matthias Van Ceulebroeck over 2 years ago
- Status changed from Review to Implemented @Emweb
- Assignee changed from Yoika Ghysens to Matthias Van Ceulebroeck
MV Updated by Matthias Van Ceulebroeck over 2 years ago
- Status changed from Implemented @Emweb to Closed
Actions