Skip to content

Commit 7f1166d

Browse files
committed
Don't allow overflowing lengths in WM_COPYDATA (#20185)
It is possible to craft a packet whose `len` is `0x80000001`. We should not produce values that do not fit in size_t (on e.g. x86). Reject them summarily. (cherry picked from commit 8edac5f) Service-Card-Id: PVTI_lADOAF3p4s4BBcTlzgr4enM Service-Version: 1.24
1 parent aa85f09 commit 7f1166d

1 file changed

Lines changed: 2 additions & 3 deletions

File tree

src/cascadia/WindowsTerminal/WindowEmperor.cpp

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,8 @@ static const uint8_t* deserializeString(const uint8_t* it, const uint8_t* end, w
9696
uint32_t len;
9797
it = deserializeUint32(it, end, len);
9898

99-
const auto bytes = static_cast<size_t>(len) * sizeof(wchar_t);
100-
101-
if (bytes == 0 || static_cast<size_t>(end - it) < bytes)
99+
size_t bytes{};
100+
if (!SUCCEEDED(SizeTMult(static_cast<size_t>(len), sizeof(wchar_t), &bytes)) || bytes == 0 || static_cast<size_t>(end - it) < bytes)
102101
{
103102
throw std::out_of_range("Not enough data for string content");
104103
}

0 commit comments

Comments
 (0)