Bug 1031 - Invalid memory access in wc_to_utf8()
Summary: Invalid memory access in wc_to_utf8()
Status: RESOLVED FIXED
Alias: None
Product: libserialport
Classification: Unclassified
Component: Port enumeration (show other bugs)
Version: unreleased development snapshot
Hardware: All Windows
: High critical
Target Milestone: ---
Assignee: Nobody
URL:
Keywords:
: 1370 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-09-10 00:37 CEST by Martin Jackson
Modified: 2019-06-30 14:42 CEST (History)
3 users (show)



Attachments
Suggested fix (736 bytes, patch)
2017-09-10 00:37 CEST, Martin Jackson
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Jackson 2017-09-10 00:37:48 CEST
Created attachment 329 [details]
Suggested fix

In wc_to_utf8() in windows.c, the zero terminator is written to an invalid array index, which results in 2 bytes being zeroed in a random place in the stack. This sometimes causes a crash when running sp_list_ports() (depending on string length and compiler optimisation settings).

sizeof(wc_str) returns the size in bytes, so cannot be used directly as an index into that array, it should be divided by sizeof(WCHAR). Otherwise the zero terminator index is approximately twice what it should be.
Comment 1 Martin Ling 2017-09-10 03:24:40 CEST
There is a commit pending in this pull request:

https://github.com/martinling/libserialport/pull/23

which replaces the whole code of this function, and may be a better fix.
Comment 2 Uwe Hermann 2019-06-30 14:25:02 CEST
Merged the patch with a commit message and faked author etc. in 38b71192dd70336eba219994b0a4219a48e4cbe1, thanks a lot!

I've been able to reproduce this with an MCP2221, and I can also confirm that it also fixes a few seemingly unrelated bugs like #1370.

The other stuff from https://github.com/martinling/libserialport/pull/23 seems to still be WIP, so I think it's better getting this specific fix merged to avoid the crashes, further patches can easily be added on top.
Comment 3 Uwe Hermann 2019-06-30 14:42:04 CEST
*** Bug 1370 has been marked as a duplicate of this bug. ***