fix: Many security and format issues

This commit is contained in:
WerWolv
2022-01-15 14:14:53 +01:00
parent 012b82c395
commit abac42826c
19 changed files with 68 additions and 48 deletions

View File

@@ -440,7 +440,7 @@ namespace hex {
if (ImGui::BeginPopup("hex.welcome.tip_of_the_day"_lang)) {
ImGui::Header("hex.welcome.tip_of_the_day"_lang, true);
ImGui::TextWrapped("%s", this->m_tipOfTheDay.c_str());
ImGui::TextFormattedWrapped("{}", this->m_tipOfTheDay.c_str());
ImGui::NewLine();
bool dontShowAgain = !this->m_showTipOfTheDay;
@@ -591,7 +591,7 @@ namespace hex {
ImGui::TableNextRow(ImGuiTableRowFlags_None, ImGui::GetTextLineHeightWithSpacing() * 3);
ImGui::TableNextColumn();
ImGui::TextWrapped("A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.");
ImGui::TextFormattedWrapped("A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.");
ImGui::TableNextRow(ImGuiTableRowFlags_None, ImGui::GetTextLineHeightWithSpacing() * 6);
ImGui::TableNextColumn();

View File

@@ -107,7 +107,10 @@ namespace hex::plugin::builtin {
});
ContentRegistry::DataInspector::add("hex.builtin.inspector.wide", sizeof(wchar_t), [](auto buffer, auto endian, auto style) {
auto c = hex::changeEndianess(*reinterpret_cast<wchar_t*>(buffer.data()), endian);
wchar_t wideChar = '\x00';
std::memcpy(&wideChar, buffer.data(), std::min(sizeof(wchar_t), buffer.size()));
auto c = hex::changeEndianess(wideChar, endian);
std::wstring_convert<std::codecvt_utf8<wchar_t>> converter("Invalid");
@@ -156,10 +159,11 @@ namespace hex::plugin::builtin {
ContentRegistry::DataInspector::add("hex.builtin.inspector.time32", sizeof(__time32_t), [](auto buffer, auto endian, auto style) {
auto endianAdjustedTime = hex::changeEndianess(*reinterpret_cast<__time32_t*>(buffer.data()), endian);
struct tm *ptm = _localtime32(&endianAdjustedTime);
struct tm ptm = { 0 };
std::string value;
if (ptm != nullptr)
value = hex::format("{0:%a, %d.%m.%Y %H:%M:%S}", *ptm);
if (_localtime32_s(&ptm, &endianAdjustedTime) == 0)
value = hex::format("{0:%a, %d.%m.%Y %H:%M:%S}", ptm);
else
value = "Invalid";
@@ -168,10 +172,11 @@ namespace hex::plugin::builtin {
ContentRegistry::DataInspector::add("hex.builtin.inspector.time64", sizeof(__time64_t), [](auto buffer, auto endian, auto style) {
auto endianAdjustedTime = hex::changeEndianess(*reinterpret_cast<__time64_t*>(buffer.data()), endian);
struct tm *ptm = _localtime64(&endianAdjustedTime);
struct tm ptm = { 0 };
std::string value;
if (ptm != nullptr)
value = hex::format("{0:%a, %d.%m.%Y %H:%M:%S}", *ptm);
if (_localtime64_s(&ptm, &endianAdjustedTime) == 0)
value = hex::format("{0:%a, %d.%m.%Y %H:%M:%S}", ptm);
else
value = "Invalid";

View File

@@ -148,9 +148,16 @@ namespace hex::plugin::builtin::prv {
result.emplace_back("hex.builtin.provider.file.size"_lang, hex::toByteString(this->getActualSize()));
if (this->m_fileStatsValid) {
result.emplace_back("hex.builtin.provider.file.creation"_lang, ctime(&this->m_fileStats.st_ctime));
result.emplace_back("hex.builtin.provider.file.access"_lang, ctime(&this->m_fileStats.st_atime));
result.emplace_back("hex.builtin.provider.file.modification"_lang, ctime(&this->m_fileStats.st_mtime));
std::string buffer(0xFF, '\x00');
if (ctime_s(buffer.data(), buffer.size(), &this->m_fileStats.st_ctime) == 0)
result.emplace_back("hex.builtin.provider.file.creation"_lang, buffer);
if (ctime_s(buffer.data(), buffer.size(), &this->m_fileStats.st_atime) == 0)
result.emplace_back("hex.builtin.provider.file.access"_lang, buffer);
if (ctime_s(buffer.data(), buffer.size(), &this->m_fileStats.st_mtime) == 0)
result.emplace_back("hex.builtin.provider.file.modification"_lang, buffer);
}
return result;

View File

@@ -364,7 +364,7 @@ namespace hex::plugin::builtin {
ImGui::PopItemWidth();
if (!lastMathError.empty())
ImGui::TextColored(ImColor(0xA00040FF), "%s", hex::format("hex.builtin.tools.error"_lang, lastMathError).c_str());
ImGui::TextFormattedColored(ImColor(0xA00040FF), "hex.builtin.tools.error"_lang, lastMathError);
else
ImGui::NewLine();
@@ -492,11 +492,11 @@ namespace hex::plugin::builtin {
static const auto WarningColor = ImColor(0.92F, 0.25F, 0.2F, 1.0F);
if (setuid && !x[0])
ImGui::TextColored(WarningColor, "%s", static_cast<const char*>("hex.builtin.tools.permissions.setuid_error"_lang));
ImGui::TextFormattedColored(WarningColor, "{}", "hex.builtin.tools.permissions.setuid_error"_lang);
if (setgid && !x[1])
ImGui::TextColored(WarningColor, "%s", static_cast<const char*>("hex.builtin.tools.permissions.setgid_error"_lang));
ImGui::TextFormattedColored(WarningColor, "{}", "hex.builtin.tools.permissions.setgid_error"_lang);
if (sticky && !x[2])
ImGui::TextColored(WarningColor, "%s", static_cast<const char*>("hex.builtin.tools.permissions.sticky_error"_lang));
ImGui::TextFormattedColored(WarningColor, "{}", "hex.builtin.tools.permissions.sticky_error"_lang);
}
@@ -629,7 +629,7 @@ namespace hex::plugin::builtin {
if (ImGui::BeginChild("##summary", ImVec2(0, 300), true)) {
if (!resultTitle.empty() && !resultExtract.empty()) {
ImGui::HeaderColored(resultTitle.c_str(), ImGui::GetCustomColorVec4(ImGuiCustomCol_Highlight),true);
ImGui::TextWrapped("%s", resultExtract.c_str());
ImGui::TextFormattedWrapped("{}", resultExtract.c_str());
}
}
ImGui::EndChild();

View File

@@ -86,8 +86,8 @@ namespace hex::plugin::builtin {
if (ImGui::BeginChild("hexData", ImVec2(0, ImGui::GetTextLineHeight() * 8), true)) {
size_t offset = region.address % 0x10;
for (size_t byte = 0; byte < 0x10; byte++) {
ImGui::TextDisabled("%02X", byte);
for (u8 byte = 0; byte < 0x10; byte++) {
ImGui::TextFormattedDisabled("{0:02X}", byte);
ImGui::SameLine();
}
@@ -160,7 +160,7 @@ namespace hex::plugin::builtin {
ImGui::Separator();
if (locked)
ImGui::TextWrapped("%s", comment.data());
ImGui::TextFormattedWrapped("{}", comment.data());
else
ImGui::InputTextMultiline("##commentInput", comment.data(), 0xF'FFFF);

View File

@@ -150,7 +150,7 @@ namespace hex::plugin::builtin {
// Draw byte
u8 byte = lineInfo[curr].bytes[col];
ImGui::TextColored(byte == 0x00 ? colorDisabled : colorText, "%s", hex::format(this->m_upperCaseHex ? "{:02X}" : "{:02x}", byte).c_str());
ImGui::TextFormattedColored(byte == 0x00 ? colorDisabled : colorText, this->m_upperCaseHex ? "{:02X}" : "{:02x}", byte);
ImGui::SameLine(0.0F, col % 8 == 7 ? glyphWidth * 1.5F : glyphWidth * 0.75F);
ImGui::SetCursorPosY(startY);
@@ -199,7 +199,7 @@ namespace hex::plugin::builtin {
{
auto glyphWidth = ImGui::CalcTextSize("0").x + 1;
for (u8 i = 0; i < 2; i++) {
for (u8 col = 0; col < this->m_columnCount; col++) {
for (u32 col = 0; col < this->m_columnCount; col++) {
ImGui::TextFormatted(this->m_upperCaseHex ? "{:02X}" : "{:02x}", col);
ImGui::SameLine(0.0F, col % 8 == 7 ? glyphWidth * 1.5F : glyphWidth * 0.75F);
}

View File

@@ -87,7 +87,7 @@ namespace hex::plugin::builtin {
disassembly.mnemonic = instructions[instr].mnemonic;
disassembly.operators = instructions[instr].op_str;
for (u8 i = 0; i < instructions[instr].size; i++)
for (u16 i = 0; i < instructions[instr].size; i++)
disassembly.bytes += hex::format("{0:02X} ", instructions[instr].bytes[i]);
disassembly.bytes.pop_back();

View File

@@ -39,7 +39,7 @@ namespace hex::plugin::builtin {
constexpr const char* Links[] = { "https://werwolv.net/donate", "https://www.patreon.com/werwolv", "https://github.com/sponsors/WerWolv" };
ImGui::TextWrapped("%s", static_cast<const char *>("hex.builtin.view.help.about.thanks"_lang));
ImGui::TextFormattedWrapped("{}", static_cast<const char *>("hex.builtin.view.help.about.thanks"_lang));
ImGui::NewLine();

View File

@@ -259,7 +259,7 @@ namespace hex::plugin::builtin {
if (ImGui::BeginPopupModal("hex.builtin.view.hexeditor.script.title"_lang, nullptr, ImGuiWindowFlags_AlwaysAutoResize)) {
ImGui::SetCursorPosX(10);
ImGui::TextWrapped("%s", static_cast<const char *>("hex.builtin.view.hexeditor.script.desc"_lang));
ImGui::TextFormattedWrapped("{}", static_cast<const char *>("hex.builtin.view.hexeditor.script.desc"_lang));
ImGui::NewLine();
ImGui::InputText("##nolabel", this->m_loaderScriptScriptPath.data(), this->m_loaderScriptScriptPath.length(), ImGuiInputTextFlags_ReadOnly);

View File

@@ -165,13 +165,13 @@ namespace hex::plugin::builtin {
if (!this->m_fileDescription.empty()) {
ImGui::TextUnformatted("hex.builtin.view.information.description"_lang);
ImGui::TextWrapped("%s", this->m_fileDescription.c_str());
ImGui::TextFormattedWrapped("{}", this->m_fileDescription.c_str());
ImGui::NewLine();
}
if (!this->m_mimeType.empty()) {
ImGui::TextUnformatted("hex.builtin.view.information.mime"_lang);
ImGui::TextWrapped("%s", this->m_mimeType.c_str());
ImGui::TextFormattedWrapped("{}", this->m_mimeType.c_str());
ImGui::NewLine();
}
@@ -222,7 +222,7 @@ namespace hex::plugin::builtin {
if (this->m_averageEntropy > 0.83 && this->m_highestBlockEntropy > 0.9) {
ImGui::NewLine();
ImGui::TextColored(ImVec4(0.92F, 0.25F, 0.2F, 1.0F), "%s", static_cast<const char*>("hex.builtin.view.information.encrypted"_lang));
ImGui::TextFormattedColored(ImVec4(0.92F, 0.25F, 0.2F, 1.0F), "{}", "hex.builtin.view.information.encrypted"_lang);
}
}

View File

@@ -525,7 +525,7 @@ namespace hex::plugin::builtin {
ImGui::SetNextWindowPos(ImGui::GetMainViewport()->GetCenter(), ImGuiCond_Appearing, ImVec2(0.5F, 0.5F));
if (ImGui::BeginPopupModal("hex.builtin.view.pattern_editor.accept_pattern"_lang, &this->m_acceptPatternWindowOpen, ImGuiWindowFlags_AlwaysAutoResize)) {
ImGui::TextWrapped("%s", static_cast<const char *>("hex.builtin.view.pattern_editor.accept_pattern.desc"_lang));
ImGui::TextFormattedWrapped("{}", static_cast<const char *>("hex.builtin.view.pattern_editor.accept_pattern.desc"_lang));
std::vector<std::string> entries;
entries.resize(this->m_possiblePatternFiles.size());

View File

@@ -136,7 +136,7 @@ namespace hex::plugin::builtin {
return 0;
}, this);
if (this->m_regex && !this->m_pattern_parsed) {
ImGui::TextColored(ImVec4(1.0f, 0.0f, 0.0f, 1.0f), "hex.builtin.view.strings.regex_error"_lang);
ImGui::TextFormattedColored(ImVec4(1.0f, 0.0f, 0.0f, 1.0f), "{}", "hex.builtin.view.strings.regex_error"_lang);
}
if (ImGui::Button("hex.builtin.view.strings.extract"_lang))
@@ -231,7 +231,7 @@ namespace hex::plugin::builtin {
if (ImGui::BeginChild("##scrolling", ImVec2(500, 150))) {
ImGui::TextUnformatted("hex.builtin.view.strings.demangle.title"_lang);
ImGui::Separator();
ImGui::TextWrapped("%s", this->m_demangledName.c_str());
ImGui::TextFormattedWrapped("{}", this->m_demangledName.c_str());
ImGui::NewLine();
if (ImGui::Button("hex.builtin.view.strings.demangle.copy"_lang))
ImGui::SetClipboardText(this->m_demangledName.c_str());

View File

@@ -48,7 +48,7 @@ namespace hex::plugin::builtin {
ImGui::Separator();
if (this->m_rules.empty()) {
ImGui::TextColored(ImVec4(0.92F, 0.25F, 0.2F, 1.0F), "%s", static_cast<const char*>("hex.builtin.view.yara.no_rules"_lang));
ImGui::TextFormattedColored(ImVec4(0.92F, 0.25F, 0.2F, 1.0F), "{}", "hex.builtin.view.yara.no_rules"_lang);
if (ImGui::Button("hex.builtin.view.yara.reload"_lang)) this->reloadRules();
} else {
@@ -113,7 +113,7 @@ namespace hex::plugin::builtin {
ImGui::TextFormatted("0x{0:X}", size);
} else {
ImGui::TableNextColumn();
ImGui::TextColored(ImVec4(0.92F, 0.25F, 0.2F, 1.0F), "%s", static_cast<const char*>("hex.builtin.view.yara.whole_data"_lang));
ImGui::TextFormattedColored(ImVec4(0.92F, 0.25F, 0.2F, 1.0F), "{}", "hex.builtin.view.yara.whole_data"_lang);
ImGui::TableNextColumn();
ImGui::TextUnformatted("");
}

View File

@@ -1067,7 +1067,7 @@ namespace hex::pl {
ImGui::TableNextColumn();
ImGui::TextFormatted("0x{0:04X}", this->getSize());
ImGui::TableNextColumn();
ImGui::TextColored(ImColor(0xFFD69C56), "struct"); ImGui::SameLine(); ImGui::TextUnformatted(this->getTypeName().c_str());
ImGui::TextFormattedColored(ImColor(0xFFD69C56), "struct"); ImGui::SameLine(); ImGui::TextUnformatted(this->getTypeName().c_str());
ImGui::TableNextColumn();
ImGui::TextFormatted("{}", this->formatDisplayValue("{ ... }", this));
}
@@ -1202,7 +1202,7 @@ namespace hex::pl {
ImGui::TableNextColumn();
ImGui::TextFormatted("0x{0:04X}", this->getSize());
ImGui::TableNextColumn();
ImGui::TextColored(ImColor(0xFFD69C56), "union"); ImGui::SameLine(); ImGui::TextUnformatted(PatternData::getTypeName().c_str());
ImGui::TextFormattedColored(ImColor(0xFFD69C56), "union"); ImGui::SameLine(); ImGui::TextUnformatted(PatternData::getTypeName().c_str());
ImGui::TableNextColumn();
ImGui::TextFormatted("{}", this->formatDisplayValue("{ ... }", this));
@@ -1357,7 +1357,7 @@ namespace hex::pl {
ImGui::TableNextColumn();
ImGui::TextFormatted("0x{0:04X}", this->getSize());
ImGui::TableNextColumn();
ImGui::TextColored(ImColor(0xFFD69C56), "enum"); ImGui::SameLine(); ImGui::TextUnformatted(PatternData::getTypeName().c_str());
ImGui::TextFormattedColored(ImColor(0xFFD69C56), "enum"); ImGui::SameLine(); ImGui::TextUnformatted(PatternData::getTypeName().c_str());
ImGui::TableNextColumn();
ImGui::TextFormatted("{}", this->formatDisplayValue(hex::format("{} (0x{:0{}X})", valueString.c_str(), value, this->getSize() * 2), this));
}
@@ -1429,7 +1429,7 @@ namespace hex::pl {
else
ImGui::TextFormatted("{0} bits", this->m_bitSize);
ImGui::TableNextColumn();
ImGui::TextColored(ImColor(0xFF9BC64D), "bits");
ImGui::TextFormattedColored(ImColor(0xFF9BC64D), "bits");
ImGui::TableNextColumn();
{
u8 numBytes = (this->m_bitSize / 8) + 1;
@@ -1505,7 +1505,7 @@ namespace hex::pl {
ImGui::TableNextColumn();
ImGui::TextFormatted("0x{0:04X}", this->getSize());
ImGui::TableNextColumn();
ImGui::TextColored(ImColor(0xFFD69C56), "bitfield"); ImGui::SameLine(); ImGui::TextUnformatted(PatternData::getTypeName().c_str());
ImGui::TextFormattedColored(ImColor(0xFFD69C56), "bitfield"); ImGui::SameLine(); ImGui::TextUnformatted(PatternData::getTypeName().c_str());
ImGui::TableNextColumn();
std::string valueString = "{ ";

View File

@@ -90,11 +90,19 @@ namespace ImGui {
void SmallProgressBar(float fraction, float yOffset = 0.0F);
void TextFormatted(const std::string &fmt, auto ... args) {
void TextFormatted(const std::string &fmt, auto&& ... args) {
ImGui::TextUnformatted(hex::format(fmt, std::forward<decltype(args)>(args)...).c_str());
}
void TextFormattedColored(ImColor color, const std::string &fmt, auto ... args) {
void TextFormattedColored(ImColor color, const std::string &fmt, auto&& ... args) {
ImGui::TextColored(color, "%s", hex::format(fmt, std::forward<decltype(args)>(args)...).c_str());
}
void TextFormattedDisabled(const std::string &fmt, auto&& ... args) {
ImGui::TextDisabled("%s", hex::format(fmt, std::forward<decltype(args)>(args)...).c_str());
}
void TextFormattedWrapped(const std::string &fmt, auto&& ... args) {
ImGui::TextWrapped("%s", hex::format(fmt, std::forward<decltype(args)>(args)...).c_str());
}
}

View File

@@ -15,7 +15,7 @@ namespace hex::dp {
auto attribute = this->getConnectedInputAttribute(index);
if (attribute == nullptr)
throwNodeError(hex::format("Nothing connected to input '{0}'", static_cast<const char*>(LangEntry(this->m_attributes[index].getUnlocalizedName()))));
throwNodeError(hex::format("Nothing connected to input '{0}'", LangEntry(this->m_attributes[index].getUnlocalizedName())));
if (attribute->getType() != Attribute::Type::Buffer)
throwNodeError("Tried to read buffer from non-buffer attribute");
@@ -35,7 +35,7 @@ namespace hex::dp {
auto attribute = this->getConnectedInputAttribute(index);
if (attribute == nullptr)
throwNodeError(hex::format("Nothing connected to input '{0}'", static_cast<const char*>(LangEntry(this->m_attributes[index].getUnlocalizedName()))));
throwNodeError(hex::format("Nothing connected to input '{0}'", LangEntry(this->m_attributes[index].getUnlocalizedName())));
if (attribute->getType() != Attribute::Type::Integer)
throwNodeError("Tried to read integer from non-integer attribute");
@@ -58,7 +58,7 @@ namespace hex::dp {
auto attribute = this->getConnectedInputAttribute(index);
if (attribute == nullptr)
throwNodeError(hex::format("Nothing connected to input '{0}'", static_cast<const char*>(LangEntry(this->m_attributes[index].getUnlocalizedName()))));
throwNodeError(hex::format("Nothing connected to input '{0}'", LangEntry(this->m_attributes[index].getUnlocalizedName())));
if (attribute->getType() != Attribute::Type::Float)
throwNodeError("Tried to read float from non-float attribute");

View File

@@ -110,7 +110,7 @@ namespace hex {
std::string code = keyword + " " + instance->ob_type->tp_name + " {\n";
for (u16 i = 0; i < PyList_Size(list); i++) {
for (Py_ssize_t i = 0; i < PyList_Size(list); i++) {
auto item = PyList_GetItem(list, i);
auto memberName = PyUnicode_AsUTF8(PyTuple_GetItem(item, 0));

View File

@@ -213,7 +213,7 @@ namespace ImGui {
void HeaderColored(const char *label, ImColor color, bool firstEntry) {
if (!firstEntry)
ImGui::NewLine();
ImGui::TextColored(color, "%s", label);
ImGui::TextFormattedColored(color, "{}", label);
ImGui::Separator();
}

View File

@@ -25,7 +25,7 @@ namespace hex {
void View::drawCommonInterfaces() {
ImGui::SetNextWindowSizeConstraints(scaled(ImVec2(400, 100)), scaled(ImVec2(600, 300)));
if (ImGui::BeginPopupModal("hex.common.info"_lang, nullptr, ImGuiWindowFlags_AlwaysAutoResize)) {
ImGui::TextWrapped("%s", SharedData::popupMessage.c_str());
ImGui::TextFormattedWrapped("{}", SharedData::popupMessage.c_str());
ImGui::NewLine();
ImGui::Separator();
if (ImGui::Button("hex.common.okay"_lang) || ImGui::IsKeyDown(ImGuiKey_Escape))
@@ -37,7 +37,7 @@ namespace hex {
ImGui::SetNextWindowSizeConstraints(scaled(ImVec2(400, 100)), scaled(ImVec2(600, 300)));
if (ImGui::BeginPopupModal("hex.common.error"_lang, nullptr, ImGuiWindowFlags_AlwaysAutoResize)) {
ImGui::TextWrapped("%s", SharedData::popupMessage.c_str());
ImGui::TextFormattedWrapped("{}", SharedData::popupMessage.c_str());
ImGui::NewLine();
ImGui::Separator();
if (ImGui::Button("hex.common.okay"_lang) || ImGui::IsKeyDown(ImGuiKey_Escape))
@@ -49,7 +49,7 @@ namespace hex {
ImGui::SetNextWindowSizeConstraints(scaled(ImVec2(400, 100)), scaled(ImVec2(600, 300)));
if (ImGui::BeginPopupModal("hex.common.fatal"_lang, nullptr, ImGuiWindowFlags_AlwaysAutoResize)) {
ImGui::TextWrapped("%s", SharedData::popupMessage.c_str());
ImGui::TextFormattedWrapped("{}", SharedData::popupMessage.c_str());
ImGui::NewLine();
ImGui::Separator();
if (ImGui::Button("hex.common.okay"_lang) || ImGui::IsKeyDown(ImGuiKey_Escape)) {