Skip to content

Commit

Permalink
winansi: check result and Buffer before using Name
Browse files Browse the repository at this point in the history
NtQueryObject under Wine can return a success but fill out no name.
In those situations, Wine will set Buffer to NULL, and set result to
the sizeof(OBJECT_NAME_INFORMATION).

Running a command such as

echo "$(git.exe --version 2>/dev/null)"

will crash due to a NULL pointer dereference when the code attempts to
null terminate the buffer, although, weirdly, removing the subshell or
redirecting stdout to a file will not trigger the crash.

Code has been added to also check Buffer and Length to ensure the check
is as robust as possible due to the current behavior being fragile at
best, and could potentially change in the future

This code is based on the behavior of NtQueryObject under wine and
reactos.

Signed-off-by: Christopher Degawa <ccom@randomderp.com>
  • Loading branch information
1480c1 authored and dscho committed Sep 18, 2024
1 parent f8b122e commit a4dc735
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions compat/winansi.c
Original file line number Diff line number Diff line change
Expand Up @@ -573,6 +573,9 @@ static void detect_msys_tty(int fd)
if (!NT_SUCCESS(NtQueryObject(h, ObjectNameInformation,
buffer, sizeof(buffer) - 2, &result)))
return;
if (result < sizeof(*nameinfo) || !nameinfo->Name.Buffer ||
!nameinfo->Name.Length)
return;
name = nameinfo->Name.Buffer;
name[nameinfo->Name.Length / sizeof(*name)] = 0;

Expand Down

0 comments on commit a4dc735

Please sign in to comment.