[newlib-cygwin] Cygwin: load_user_profile: fix use-after-free issue
Corinna Vinschen
corinna@sourceware.org
Fri Mar 1 20:09:00 GMT 2019
https://sourceware.org/git/gitweb.cgi?p=newlib-cygwin.git;h=7ba9d12a72a722e0f20a80716dbeaf293e66a714
commit 7ba9d12a72a722e0f20a80716dbeaf293e66a714
Author: Corinna Vinschen <corinna@vinschen.de>
Date: Fri Mar 1 21:04:02 2019 +0100
Cygwin: load_user_profile: fix use-after-free issue
In case of a local machine account login, pi.lpProfilePath points
to the buffer returned by NetUserGetInfo, but NetApiBufferFree
is called prior to calling LoadUserProfileW. Fix by copying over
usri3_profile to the local userpath buffer, just as in the AD case.
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
Diff:
---
winsup/cygwin/sec_auth.cc | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/winsup/cygwin/sec_auth.cc b/winsup/cygwin/sec_auth.cc
index 0b5e112..077b37c 100644
--- a/winsup/cygwin/sec_auth.cc
+++ b/winsup/cygwin/sec_auth.cc
@@ -267,7 +267,11 @@ load_user_profile (HANDLE token, struct passwd *pw, cygpsid &usersid)
else
{
if (ui->usri3_profile && *ui->usri3_profile)
- pi.lpProfilePath = ui->usri3_profile;
+ {
+ wcsncpy (userpath, ui->usri3_profile, MAX_PATH - 1);
+ userpath[MAX_PATH - 1] = L'\0';
+ pi.lpProfilePath = userpath;
+ }
NetApiBufferFree (ui);
}
}
More information about the Cygwin-cvs
mailing list