diff options
Diffstat (limited to 'winsup/cygwin')
| -rw-r--r-- | winsup/cygwin/release/3.5.5 | 3 | ||||
| -rw-r--r-- | winsup/cygwin/syscalls.cc | 10 |
2 files changed, 9 insertions, 4 deletions
diff --git a/winsup/cygwin/release/3.5.5 b/winsup/cygwin/release/3.5.5 index 2ca4572..3088f86 100644 --- a/winsup/cygwin/release/3.5.5 +++ b/winsup/cygwin/release/3.5.5 @@ -33,3 +33,6 @@ Fixes: - Fix type of pthread_sigqueue() first parameter to match Linux. Addresses: https://cygwin.com/pipermail/cygwin/2024-September/256439.html + +- Fix potential stack corruption in rmdir() in a border case. + Addresses: https://cygwin.com/pipermail/cygwin/2024-November/256774.html diff --git a/winsup/cygwin/syscalls.cc b/winsup/cygwin/syscalls.cc index df7d3a1..433739c 100644 --- a/winsup/cygwin/syscalls.cc +++ b/winsup/cygwin/syscalls.cc @@ -617,9 +617,10 @@ check_dir_not_empty (HANDLE dir, path_conv &pc) IO_STATUS_BLOCK io; const ULONG bufsiz = 3 * sizeof (FILE_NAMES_INFORMATION) + 3 * NAME_MAX * sizeof (WCHAR); - PFILE_NAMES_INFORMATION pfni = (PFILE_NAMES_INFORMATION) - alloca (bufsiz); - NTSTATUS status = NtQueryDirectoryFile (dir, NULL, NULL, 0, &io, pfni, + PFILE_NAMES_INFORMATION pfni_buf = (PFILE_NAMES_INFORMATION) + alloca (bufsiz); + PFILE_NAMES_INFORMATION pfni; + NTSTATUS status = NtQueryDirectoryFile (dir, NULL, NULL, 0, &io, pfni_buf, bufsiz, FileNamesInformation, FALSE, NULL, TRUE); if (!NT_SUCCESS (status)) @@ -631,6 +632,7 @@ check_dir_not_empty (HANDLE dir, path_conv &pc) int cnt = 1; do { + pfni = pfni_buf; while (pfni->NextEntryOffset) { if (++cnt > 2) @@ -677,7 +679,7 @@ check_dir_not_empty (HANDLE dir, path_conv &pc) pfni = (PFILE_NAMES_INFORMATION) ((caddr_t) pfni + pfni->NextEntryOffset); } } - while (NT_SUCCESS (NtQueryDirectoryFile (dir, NULL, NULL, 0, &io, pfni, + while (NT_SUCCESS (NtQueryDirectoryFile (dir, NULL, NULL, 0, &io, pfni_buf, bufsiz, FileNamesInformation, FALSE, NULL, FALSE))); return STATUS_SUCCESS; |