search

synopse / mORMot

Synopse mORMot 1 ORM/SOA/MVC framework - Please upgrade to mORMot 2 !
https://synopse.info
785 stars 323 forks source link

Bufferoverread for THttpServerRequest.FullUrl #429

Closed chrswgnr closed 2 years ago

chrswgnr commented 2 years ago

Hey, i used the THttpApiServer from current master branch, and attached a OnRequest handler. I had to notice that a bufferoverread happens for the FullUrl from THttpServerRequest. This is only the case for THttpServerRequest.FullUrl, THttpServerRequest.Url is correct.

image

Since the nullterminator is correct there, i current work around that by using Split([#0])[0]

synopse commented 2 years ago

This is weird, because the length comes directly from the Windows API, i.e. Req^.CookedUrl.FullUrlLength. Please try https://synopse.info/fossil/info/cb30095a75

chrswgnr commented 2 years ago

I tested your patch, with those changes it's fixed.

image

Well maybe a bug in the windows api then. I am on a Windows 10 Enterprise 1909 right now.

synopse commented 2 years ago

After more checking, the length was in bytes, not WideChars (as would be logical), so my code was incorrect. Using ending #0 as in my fix is always good, and not really slower, so we will keep it. ;) Thanks for the report.

chrswgnr commented 2 years ago

Alright! Thanks for the quick reply and fix! :)