Validate string lengths and item counts in cached help books (PR #26766)

MarkLee131

unread,

Jul 31, 2026, 10:41:19 AM (4 days ago) Jul 31

to wx-...@googlegroups.com, Subscribed

CacheReadString() now returns a bool and takes the string by reference, so a .cached file that CacheWriteString() could not have produced is rejected instead of being acted on:

a stored length below 1 is refused, which is what made len - 1 underflow to SIZE_MAX and wxCharBuffer write its terminator one byte in front of a zero-sized block
a length larger than the file is refused
the buffer is sized as len rather than len - 1, so reading len bytes leaves the terminator intact. ReadString() in src/common/zipstrm.cpp:88 already does it this way
the read has to deliver the bytes it asked for
the last byte has to be the NUL that CacheWriteString() always writes, and the string is then built from the known length rather than by scanning

A new CacheReadCount() bounds the contents and index counts against the file before Alloc() sees them, since a count larger than the file cannot be real. CacheReadInt32() initialises its temporary. The contents loop moves to
std::make_unique so the new early returns cannot leak, which is what the index loop already does since ebd86dee67.

Five tests in tests/html/helpdata.cpp, next to the existing BadCachedParent.
Checked under ASAN as well: the five .htb files from the issue report a heap-buffer-overflow write, an allocator abort or a hang before the change, and are clean after it.

One thing I left alone: when GetLength() is not usable on the stream, a declared length of 0x7FFFFFFF still allocates 2 GB briefly before the short-read check rejects it. Capping that would mean choosing a limit, and there is no natural one here, so I have not.

You can view, comment on, or merge this pull request online at:

https://github.com/wxWidgets/wxWidgets/pull/26766

Commit Summary

ad14e04 Validate string lengths and item counts in cached help books

File Changes

(2 files)

M src/html/helpdata.cpp (79)
M tests/html/helpdata.cpp (87)

Patch Links:

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.

VZ

unread,

Aug 1, 2026, 8:04:32 AM (3 days ago) Aug 1

to wx-...@googlegroups.com, Subscribed

vadz left a comment (wxWidgets/wxWidgets#26766)

This also looks good and thanks for the extensive tests!

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!

You are receiving this because you are subscribed to this thread.

VZ

unread,

Aug 1, 2026, 8:05:38 AM (3 days ago) Aug 1

to wx-...@googlegroups.com, Subscribed

Closed #26766 via 09cebab.

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!

You are receiving this because you are subscribed to this thread.

Reply all

Reply to author

Forward