loader: fix heap overflow when registry path exceeds reg_data buffer#1916
Open
aizu-m wants to merge 1 commit into
Open
loader: fix heap overflow when registry path exceeds reg_data buffer#1916aizu-m wants to merge 1 commit into
aizu-m wants to merge 1 commit into
Conversation
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
1 similar comment
|
Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build. |
|
CI Vulkan-Loader build queued with queue ID 761419. |
|
CI Vulkan-Loader build # 3506 running. |
|
CI Vulkan-Loader build # 3506 aborted. |
|
CI Vulkan-Loader build queued with queue ID 761647. |
|
CI Vulkan-Loader build # 3508 running. |
|
CI Vulkan-Loader build # 3508 passed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reading the registry path code I noticed reg_data is allocated at total_size (4096 by default) but each snprintf in windows_add_json_entry is bounded by json_size, the registry value size that windows_get_device_registry_entry reads with RegQueryValueEx (and the D3DKMT adapter query passes in). That size is uncapped. Pulling the buffer logic out into a small harness, a 9000-byte driver/layer JSON path lands like this:
The NULL branch never checks json_size against total_size, and the realloc branch only doubles the size once, so any single REG_SZ/REG_MULTI_SZ path longer than the buffer overflows it.
Grow the buffer until the value actually fits and bound each snprintf by the remaining destination space. windows_get_registry_files has the same single-double plus source-length-bounded snprintf shape (its name is capped at 2048 so it is only an off-by-one at the capacity boundary) and gets the same treatment.