Skip to content

fix out-of-bounds read in windows_read_manifest_from_d3d_adapters#1966

Open
aizu-m wants to merge 1 commit into
KhronosGroup:mainfrom
aizu-m:d3d-adapter-utf8-oob-read
Open

fix out-of-bounds read in windows_read_manifest_from_d3d_adapters#1966
aizu-m wants to merge 1 commit into
KhronosGroup:mainfrom
aizu-m:d3d-adapter-utf8-oob-read

Conversation

@aizu-m

@aizu-m aizu-m commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

Was reading why the D3D adapter path converts its registry strings differently to the rest of the loader, which is where this turned up.

  1. json_path is sized to output_value_size, the UTF-16 byte length of the path.
  2. the UTF-8 form can be longer, since a U+0800 to U+FFFF code point is 2 bytes in UTF-16 and 3 in UTF-8, so WideCharToMultiByte returns 0 and leaves json_path unterminated.
  3. that return was ignored, so strlen(json_path) then walked off the end of the allocation.

Reachable from D3DKMT adapter data during driver and layer discovery. Every other WideCharToMultiByte call in the loader either queries the size first or checks the result. Took the return value as the length and skip the entry when it comes back 0.

@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants