diff options
| -rw-r--r-- | winsup/cygwin/release/3.1.6 | 3 | ||||
| -rw-r--r-- | winsup/cygwin/strfuncs.cc | 34 |
2 files changed, 23 insertions, 14 deletions
diff --git a/winsup/cygwin/release/3.1.6 b/winsup/cygwin/release/3.1.6 index d64ee4c92..e06c0bc9a 100644 --- a/winsup/cygwin/release/3.1.6 +++ b/winsup/cygwin/release/3.1.6 @@ -9,3 +9,6 @@ Bug Fixes: ---------- - Fix IPPROTO_TCP option handling, especially in terms of TCP_MAXSEG. + +- Fix a buffer overrun in Cygwin-internal string comparison. + Fixes: https://cygwin.com/pipermail/cygwin/2020-June/245226.html diff --git a/winsup/cygwin/strfuncs.cc b/winsup/cygwin/strfuncs.cc index e0a4c7182..604d7611c 100644 --- a/winsup/cygwin/strfuncs.cc +++ b/winsup/cygwin/strfuncs.cc @@ -635,7 +635,7 @@ sys_cp_mbstowcs (mbtowc_p f_mbtowc, wchar_t *dst, size_t dlen, /* The technique is based on a discussion here: http://www.mail-archive.com/linux-utf8@nl.linux.org/msg00080.html - Invalid bytes in a multibyte secuence are converted to + Invalid bytes in a multibyte sequence are converted to the private use area which is already used to store ASCII chars invalid in Windows filenames. This technque allows to store them in a symmetric way. */ @@ -801,14 +801,18 @@ extern "C" int __stdcall cygwin_strcasecmp (const char *cs, const char *ct) { UNICODE_STRING us, ut; - ULONG len; - - len = (strlen (cs) + 1) * sizeof (WCHAR); - RtlInitEmptyUnicodeString (&us, (PWCHAR) alloca (len), len); - us.Length = sys_mbstowcs (us.Buffer, us.MaximumLength, cs) * sizeof (WCHAR); - len = (strlen (ct) + 1) * sizeof (WCHAR); - RtlInitEmptyUnicodeString (&ut, (PWCHAR) alloca (len), len); - ut.Length = sys_mbstowcs (ut.Buffer, ut.MaximumLength, ct) * sizeof (WCHAR); + ULONG len, ulen; + + len = strlen (cs) + 1; + ulen = len * sizeof (WCHAR); + RtlInitEmptyUnicodeString (&us, (PWCHAR) alloca (ulen), ulen); + us.Length = sys_mbstowcs (us.Buffer, len, cs) * sizeof (WCHAR); + + len = strlen (ct) + 1; + ulen = len * sizeof (WCHAR); + RtlInitEmptyUnicodeString (&ut, (PWCHAR) alloca (ulen), ulen); + ut.Length = sys_mbstowcs (ut.Buffer, len, ct) * sizeof (WCHAR); + return RtlCompareUnicodeString (&us, &ut, TRUE); } @@ -816,19 +820,21 @@ extern "C" int __stdcall cygwin_strncasecmp (const char *cs, const char *ct, size_t n) { UNICODE_STRING us, ut; - ULONG len; + ULONG ulen; size_t ls = 0, lt = 0; while (cs[ls] && ls < n) ++ls; - len = (ls + 1) * sizeof (WCHAR); - RtlInitEmptyUnicodeString (&us, (PWCHAR) alloca (len), len); + ulen = (ls + 1) * sizeof (WCHAR); + RtlInitEmptyUnicodeString (&us, (PWCHAR) alloca (ulen), ulen); us.Length = sys_mbstowcs (us.Buffer, ls + 1, cs, ls) * sizeof (WCHAR); + while (ct[lt] && lt < n) ++lt; - len = (lt + 1) * sizeof (WCHAR); - RtlInitEmptyUnicodeString (&ut, (PWCHAR) alloca (len), len); + ulen = (lt + 1) * sizeof (WCHAR); + RtlInitEmptyUnicodeString (&ut, (PWCHAR) alloca (ulen), ulen); ut.Length = sys_mbstowcs (ut.Buffer, lt + 1, ct, lt) * sizeof (WCHAR); + return RtlCompareUnicodeString (&us, &ut, TRUE); } |