x/sys/windows, internal/syscall/windows: integer overflow in NewNTUnicodeString

[neild]

NewNTUnicodeString did not check for string length overflow.
When provided with a string that overflows the maximum size of
a NTUnicodeString (a 16-bit number of bytes), it returned a truncated
string rather than an error.

It now correctly returns an error when provided with a too-long string.

This is CVE-2026-39824 and Go issue https://go.dev/issue/78916.

---

This was a PUBLIC track issue, tracked in http://b/502133867.

[qmuntal]

the attacker needs to first convince the victim to open a file which exists, is a symlink (or other form of reparse point), and has a name longer than 2^16-1 characters

The maximum path length on Windows is 2^15-1 characters, see https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation?tabs=registry. AFAIU, this attack vector is not possible, so the Go standard library shouldn't be affected by this vulnerability.

[gopherbot]

Change https://go.dev/cl/770100 mentions this issue: internal/syscall/windows: avoid uint16 overflow in NewNTUnicodeString

[thaJeztah]

This was just announced as a fix in golang.org/x/sys v0.45.0, but wasn't this already fixed in v0.44.0? (in this commit golang/sys@fb1facd)

https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg