Jump to content
Sign in to follow this  
flarn2006

Found an interesting buffer overflow bug (not a security risk AFAIK)

Recommended Posts

Easy to reproduce; just follow  these steps:

  1. Place an Initialize Array node in the block diagram
  2. Make it a large number of dimensions (really anything more than 1 will work, but do more for full effect)
  3. Do not connect anything to the Initialize Array, so it remains void
  4. Right-click the output terminal, and go to Create->Indicator
  5. Look at the index displays on the front panel.

When the array indicator is created, it's supposed to set aside memory to store the selected indices for however many dimensions are needed. But apparently, if the type is void, it only sets aside room for one dimension, leaving the additional index displays pointing to addresses that are supposed to be used for other things. I searched for the values that appeared using Cheat Engine, and sure enough, it cuts into a section of memory that looks like it's being used for something else.

 

On a side note, just for fun I changed the values on all the index displays, and one of the index displays changed to show garbage characters. Then when I closed the VI, LabVIEW crashed. So yeah, it looks like a buffer overflow.

 

This is in 2014 btw.

Edited by flarn2006
  • Like 1

Share this post


Link to post
Share on other sites

Easy to reproduce; just follow  these steps:

  1. Place an Initialize Array node in the block diagram
  2. Make it a large number of dimensions (really anything more than 1 will work, but do more for full effect)
  3. Do not connect anything to the Initialize Array, so it remains void
  4. Right-click the output terminal, and go to Create->Indicator
  5. Look at the index displays on the front panel.

When the array indicator is created, it's supposed to set aside memory to store the selected indices for however many dimensions are needed. But apparently, if the type is void, it only sets aside room for one dimension, leaving the additional index displays pointing to addresses that are supposed to be used for other things. I searched for the values that appeared using Cheat Engine, and sure enough, it cuts into a section of memory that looks like it's being used for something else.

 

On a side note, just for fun I changed the values on all the index displays, and one of the index displays changed to show garbage characters. Then when I closed the VI, LabVIEW crashed. So yeah, it looks like a buffer overflow.

 

This is in 2014 btw.

 

Confirmed. Introduced in LV 2013 and doesn't affect LV 64 bit...

Share this post


Link to post
Share on other sites

Hmm, just tried it with the LV versions that I have and I can reproduce it in all versions

 

7.1.1

8

2010 32bit

2013 32bit

2013 64bit

2014 32bit

2013 64bit

Share this post


Link to post
Share on other sites

Changing a void constant with lots of dimensions to control and then back to constant causes a crash for me

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.