[PATCH] mingw: consider that UNICODE_STRING::Length counts bytes

Subsystems: the rest

STALE3513d

2 messages, 2 authors, 2016-12-20 · open the first message on its own page

[PATCH] mingw: consider that UNICODE_STRING::Length counts bytes

From: Max Kirillov <hidden>
Date: 2016-12-19 21:33:57

UNICODE_STRING::Length field means size of buffer in bytes[1], despite of buffer
itself being array of wchar_t. Because of that terminating zero is placed twice
as far. Fix it.

[1] https://msdn.microsoft.com/en-us/library/windows/desktop/aa380518.aspx

Signed-off-by: Max Kirillov <redacted>
---
Access outside of buffer was very unlikely (for that user needed to redirect
standard fd to a file with path longer than ~250 symbols), it still did not
seem to do any harm, and otherwise it did not break because only substring is
checked, but it was still incorrect.
 compat/winansi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/compat/winansi.c b/compat/winansi.c
index 3be60ce..6b4f736 100644
--- a/compat/winansi.c
+++ b/compat/winansi.c
@@ -553,7 +553,7 @@ static void detect_msys_tty(int fd)
 			buffer, sizeof(buffer) - 2, &result)))
 		return;
 	name = nameinfo->Name.Buffer;
-	name[nameinfo->Name.Length] = 0;
+	name[nameinfo->Name.Length / sizeof(*name)] = 0;
 
 	/* check if this could be a MSYS2 pty pipe ('msys-XXXX-ptyN-XX') */
 	if (!wcsstr(name, L"msys-") || !wcsstr(name, L"-pty"))
-- 
2.3.4.2801.g3d0809b

Re: [PATCH] mingw: consider that UNICODE_STRING::Length counts bytes

From: Johannes Schindelin <hidden>
Date: 2016-12-20 15:16:38

Hi Max,

On Mon, 19 Dec 2016, Max Kirillov wrote:
UNICODE_STRING::Length field means size of buffer in bytes[1], despite
of buffer itself being array of wchar_t. Because of that terminating
zero is placed twice as far. Fix it.
This commit message needs to be wrapped at <= 76 columns per row.
[1] https://msdn.microsoft.com/en-us/library/windows/desktop/aa380518.aspx

Signed-off-by: Max Kirillov <redacted>
---
Access outside of buffer was very unlikely (for that user needed to redirect
standard fd to a file with path longer than ~250 symbols), it still did not
seem to do any harm, and otherwise it did not break because only substring is
checked, but it was still incorrect.
Very good, thank you for fixing my mistake! I verified locally that it
does exactly the right thing with your patch.

ACK,
Dscho
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help