Skip to content

Commit 039a4cd

Browse files
committed
winansi: check result before using Name for pty
NtQueryObject under Wine can return a success but fill out no name. In those situations, Wine will set Buffer to NULL, and set result to the sizeof(OBJECT_NAME_INFORMATION). Running a command such as echo "$(git.exe --version 2>/dev/null)" will crash due to a NULL pointer dereference when the code attempts to null terminate the buffer, although, weirdly, removing the subshell or redirecting stdout to a file will not trigger the crash. Alternatives include checking Buffer itself, however, I am not sure what is the official behavior of the function due to a lack of documentation. Another alternative is to check the Length field, but similar to above, I do not know what the official behavior is. This code is based on the behavior of NtQueryObject under wine and reactos. Signed-off-by: Christopher Degawa <[email protected]>
1 parent 590ade5 commit 039a4cd

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

compat/winansi.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -573,6 +573,8 @@ static void detect_msys_tty(int fd)
573573
if (!NT_SUCCESS(NtQueryObject(h, ObjectNameInformation,
574574
buffer, sizeof(buffer) - 2, &result)))
575575
return;
576+
if (result <= sizeof(*nameinfo))
577+
return;
576578
name = nameinfo->Name.Buffer;
577579
name[nameinfo->Name.Length / sizeof(*name)] = 0;
578580

0 commit comments

Comments
 (0)