Skip to content

Commit 05bcc8d

Browse files
committed
Fix potential out of bounds read
In some situations involving long paths it is possible that `GetFileInformationByHandleEx` produces a `FILE_NAME_INFO` with `FileNameLength` exceeding the provided buffer [1]. Return `false` from `msys_tty_on` if that happens, instead of reading beyond the end of the allocation. [1] sunfishcode/is-terminal#18
1 parent f13bbb8 commit 05bcc8d

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

src/windows_term/mod.rs

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -548,10 +548,14 @@ pub fn msys_tty_on(term: &Term) -> bool {
548548
return false;
549549
}
550550

551-
let s = slice::from_raw_parts(
552-
name_info.FileName.as_ptr(),
553-
name_info.FileNameLength as usize / 2,
554-
);
551+
// Use `get` because `FileNameLength` can be out of range.
552+
let s = match name_info
553+
.FileName
554+
.get(..name_info.FileNameLength as usize / 2)
555+
{
556+
Some(s) => s,
557+
None => return false,
558+
};
555559
let name = String::from_utf16_lossy(s);
556560
// This checks whether 'pty' exists in the file name, which indicates that
557561
// a pseudo-terminal is attached. To mitigate against false positives

0 commit comments

Comments
 (0)