You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've been looking into it and the use of strlen seems appropriate in this case. From MSDN, "strnlen is not a replacement for strlen; strnlen is intended to be used only to calculate the size of incoming untrusted data in a buffer of known size—for example, a network packet"
It is used twice within ...\src\powershell-native\nativemsh\CssMainEntry.cpp. One invocation of it calculates the length of a hardcoded string that is guaranteed to be null terminated. The other invocation calculates the length of a string passed in as a command-line argument. In the second instance, we do not know the length of the incoming string so it would introduce a bug to artificially guess the value.
Activity
SteveL-MSFT commentedon Oct 3, 2017
Mike Richmond (@mirichmo) can you take this one?
mirichmo commentedon Oct 12, 2017
I've been looking into it and the use of
strlenseems appropriate in this case. From MSDN, "strnlen is not a replacement for strlen; strnlen is intended to be used only to calculate the size of incoming untrusted data in a buffer of known size—for example, a network packet"It is used twice within ...\src\powershell-native\nativemsh\CssMainEntry.cpp. One invocation of it calculates the length of a hardcoded string that is guaranteed to be null terminated. The other invocation calculates the length of a string passed in as a command-line argument. In the second instance, we do not know the length of the incoming string so it would introduce a bug to artificially guess the value.
TravisEz13 commentedon Oct 12, 2017
this is not an appropriate resolution. This issue is 'must fix'. Please speak with me before closing.