Skip to content

Conversation

MiroKaku
Copy link
Contributor

code segment (from: hidtest):

#define MAX_STR 255
wchar_t wstr[MAX_STR];             // !!! <----- wstr[255]; 0~254;

// Read the Manufacturer String
wstr[0] = 0x0000;
res = hid_get_manufacturer_string(handle, wstr, MAX_STR);

int HID_API_EXPORT_CALL HID_API_CALL hid_get_product_string(hid_device *dev, wchar_t *string, size_t maxlen)
{
	if (!dev->device_info)
	{
		register_string_error(dev, L"NULL device/info");
		return -1;
	}

	if (!string || !maxlen)
	{
		register_string_error(dev, L"Zero buffer/length");
		return -1;
	}


	wcsncpy(string, dev->device_info->product_string, maxlen);
	string[maxlen] = L'\0';      // !!! <----- string[255] = L'\0'; boom!
        // fixed: string[maxlen - 1] = L'\0';

	return 0;
}

@MiroKaku MiroKaku changed the title Fix: memory write out of bounds. Fix: memory write out of bounds. (windows) May 24, 2022
Copy link
Member

@Youw Youw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting why no one caught this one earlier.

@MiroKaku
Copy link
Contributor Author

Interesting why no one caught this one earlier.

Maybe few Windows developers. 😅

@Youw
Copy link
Member

Youw commented May 25, 2022

Or few who use those API(s).

@Youw Youw merged commit 844e468 into libusb:master May 25, 2022
@mcuee mcuee added the Windows Related to Windows backend label Jul 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Windows Related to Windows backend
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants