Skip to content

Commit

Permalink
Prevent out-of-bounds read if strings are not \0 terminated
Browse files Browse the repository at this point in the history
The documentation does not state whether the strings in DEVMODE are
\0 terminated so assume they might be not
  • Loading branch information
matthiasblaesing committed Oct 21, 2023
1 parent 0477646 commit eeda6e0
Showing 1 changed file with 12 additions and 7 deletions.
19 changes: 12 additions & 7 deletions contrib/platform/src/com/sun/jna/platform/win32/WinGDI.java
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,16 @@
*/
package com.sun.jna.platform.win32;

import com.sun.jna.Native;
import com.sun.jna.NativeLong;
import com.sun.jna.Pointer;
import com.sun.jna.Structure;
import com.sun.jna.Structure.FieldOrder;
import com.sun.jna.platform.win32.WinNT.HANDLE;
import com.sun.jna.Union;

import java.text.ParseException;

import static com.sun.jna.platform.win32.WinDef.*;
import java.nio.charset.StandardCharsets;

/**
* Ported from WinGDI.h.
Expand Down Expand Up @@ -276,19 +276,24 @@ public static class ByReference extends DEVMODE implements Structure.ByReference
* Converts dmDeviceName from raw byte[] to String
*/
public String getDmDeviceName() {
int offset = fieldOffset("dmDeviceName");
return CHAR_WIDTH == 1 ? getPointer().getString(offset) : getPointer().getWideString(offset);
if(CHAR_WIDTH == 1) {
return Native.toString(dmFormName);
} else {
return new String(dmDeviceName, StandardCharsets.UTF_16LE);
}
}

/**
* Converts dmFormName from raw byte[] to String
*/
public String getDmFormName() {
int offset = fieldOffset("dmFormName");
return CHAR_WIDTH == 1 ? getPointer().getString(offset) : getPointer().getWideString(offset);
if(CHAR_WIDTH == 1) {
return Native.toString(dmFormName);
} else {
return new String(dmFormName, StandardCharsets.UTF_16LE);
}
}


public static class DUMMYUNIONNAME extends Union {
public DUMMYSTRUCTNAME dummystructname;

Expand Down

0 comments on commit eeda6e0

Please sign in to comment.