Corinna Vinschen bb96bd03b0 Cygwin: fix buffer overrun in cygwin_strcasecmp
sys_mbstowcs is called with the destination buffer length
set to MaximumLength from the receiving UNICODE_STRING buffer.
This is twice as much as the actual size of the buffer in
wchar_t units, which is the unit expected by sys_mbstowcs.

sys_mbstowcs always attaches a NUL, within the destination
buffersize given.  But if the string is exactly one wchar_t
less than the actual buffer, and the buffersize is given too
large, sys_mbstowcs writes a NUL one wchar_t beyond the buffer.

This has only been exposed with Cygwin 3.1.5 because alloca
on newer gcc 9 apparently allocates more tightly.  The alloca
buffer here is requested with 16 bytes, which is exactly the
number of bytes required for the string L"cmd.exe".  Older gcc
apparently allocated a few more bytes on the stack, while gcc 9
allocates in 16 byte granularity...

Fix this by giving the correct destination buffer size to
sys_mbstowcs.

Fixes: https://cygwin.com/pipermail/cygwin/2020-June/245226.html
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
2020-07-06 13:17:53 +02:00
..
2020-07-01 21:26:59 +02:00
2020-05-30 19:41:18 +02:00
2020-05-26 10:22:41 +02:00
2016-06-25 00:43:01 +02:00
2019-10-23 10:05:42 +02:00
2019-10-23 10:05:42 +02:00
2014-04-26 17:38:22 +00:00
2018-02-20 17:59:53 +01:00
2020-07-01 21:26:59 +02:00
2015-03-03 12:58:34 +00:00
2017-03-27 22:03:58 +01:00
2015-08-17 11:05:43 +02:00
2018-04-16 22:46:11 -05:00
2018-02-07 13:07:44 +01:00
2020-05-11 09:52:16 -04:00
2019-06-25 15:44:43 -04:00
2019-06-25 15:44:43 -04:00
2019-07-19 14:14:33 -04:00
2020-07-01 20:30:52 +02:00