Fix: memory write out of bounds. (windows) #418

Merged

MiroKaku merged 1 commit from master into master

2022-05-25 07:49:48 -05:00

MiroKaku commented

2022-05-24 05:22:10 -05:00

(Migrated from github.com)

code segment (from: hidtest):

#define MAX_STR 255
wchar_t wstr[MAX_STR];             // !!! <----- wstr[255]; 0~254;

// Read the Manufacturer String
wstr[0] = 0x0000;
res = hid_get_manufacturer_string(handle, wstr, MAX_STR);

int HID_API_EXPORT_CALL HID_API_CALL hid_get_product_string(hid_device *dev, wchar_t *string, size_t maxlen)
{
	if (!dev->device_info)
	{
		register_string_error(dev, L"NULL device/info");
		return -1;
	}

	if (!string || !maxlen)
	{
		register_string_error(dev, L"Zero buffer/length");
		return -1;
	}


	wcsncpy(string, dev->device_info->product_string, maxlen);
	string[maxlen] = L'\0';      // !!! <----- string[255] = L'\0'; boom!
        // fixed: string[maxlen - 1] = L'\0';

	return 0;
}

code segment (from: [hidtest](https://github.com/libusb/hidapi/blob/master/hidtest/test.c)): ```C #define MAX_STR 255 wchar_t wstr[MAX_STR]; // !!! <----- wstr[255]; 0~254; // Read the Manufacturer String wstr[0] = 0x0000; res = hid_get_manufacturer_string(handle, wstr, MAX_STR); int HID_API_EXPORT_CALL HID_API_CALL hid_get_product_string(hid_device *dev, wchar_t *string, size_t maxlen) { if (!dev->device_info) { register_string_error(dev, L"NULL device/info"); return -1; } if (!string || !maxlen) { register_string_error(dev, L"Zero buffer/length"); return -1; } wcsncpy(string, dev->device_info->product_string, maxlen); string[maxlen] = L'\0'; // !!! <----- string[255] = L'\0'; boom! // fixed: string[maxlen - 1] = L'\0'; return 0; } ```

Youw (Migrated from github.com) approved these changes

2022-05-24 11:26:39 -05:00

Youw (Migrated from github.com) left a comment