Skip to content

Commit

Permalink
winansi: check result and Buffer before using Name
Browse files Browse the repository at this point in the history
NtQueryObject under Wine can return a success but fill out no name.
In those situations, Wine will set Buffer to NULL, and set result to
the sizeof(OBJECT_NAME_INFORMATION).

Running a command such as

echo "$(git.exe --version 2>/dev/null)"

will crash due to a NULL pointer dereference when the code attempts to
null terminate the buffer, although, weirdly, removing the subshell or
redirecting stdout to a file will not trigger the crash.

Code has been added to also check Buffer and Length to ensure the check
is as robust as possible due to the current behavior being fragile at
best, and could potentially change in the future

This code is based on the behavior of NtQueryObject under wine and
reactos.

Signed-off-by: Christopher Degawa <ccom@randomderp.com>
  • Loading branch information
1480c1 authored and dscho committed Sep 22, 2022
1 parent 0f63eac commit f060165
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions compat/winansi.c
Expand Up @@ -573,6 +573,9 @@ static void detect_msys_tty(int fd)
if (!NT_SUCCESS(NtQueryObject(h, ObjectNameInformation,
buffer, sizeof(buffer) - 2, &result)))
return;
if (result < sizeof(*nameinfo) || !nameinfo->Name.Buffer ||
!nameinfo->Name.Length)
return;
name = nameinfo->Name.Buffer;
name[nameinfo->Name.Length / sizeof(*name)] = 0;

Expand Down

0 comments on commit f060165

Please sign in to comment.