# A stack buffer overflow in BabyGrid.cpp can lead to program crashes via a malicious localization file

Unbounded lstrcat/lstrcpy in BabyGrid.cpp overflow 1000-byte stack buffers when a malicious nativeLang.xml supplies long ShortcutMapper column names, crashing Notepad++.

- Payout: hidden
- Severity: low
- Program: Notepad++
- Found by: peter_
- Disclosed: 2019-05-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/497255
- Library page: https://bugbountylibrary.com/r/h1%3A497255
- Tags: area:os domain:desktop impact:dos kind:bounty platform:hackerone sev:low tech:windows technique:source-review vuln:dos vuln:memory-corruption

**Target:** BabyGrid.cpp grid cell rendering (Shortcut Mapper) via nativeLang.xml
**Root cause:** lstrcat and lstrcpy copy attacker-controlled localization strings into fixed 1000-byte stack buffers without bounds checks.
**Steps:**
1. Place a nativeLang.xml in %APPDATA%\Notepad++ with a ShortcutMapper child tag (e.g. ColumnName) whose name attribute exceeds ~1000 chars (32-bit) or ~2000 chars (64-bit).
2. Run Notepad++ and open Settings > Shortcut Mapper.
3. GridProc calls `lstrcat(buffer, (TCHAR*)lParam);` overflowing buffer; FindLongestLine calls `lstrcpy(temptext,text);` overflowing temptext.
4. Program crashes.
**How found:** Code review of BabyGrid.cpp message handling traced from ShortcutMapper::fillOutBabyGrid through setText/SendMessage to GridProc, spotting unsafe lstrcat/lstrcpy on localization strings.
**Exploitation:** Attacker convinces user to install a crafted localization file (or a local process writes to %APPDATA%); opening Shortcut Mapper triggers the overflow and crash. Code execution deemed impractical due to stack cookie and ASLR.
**Insight:** Localization/config files feeding GUI string setters are attacker-influenced input; trace SendMessage-based cell setters to their string copy routines to find unbounded stack copies.