Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential crash when calling ITerminalConnection::WriteInput #17697

Closed
j4james opened this issue Aug 10, 2024 · 0 comments · Fixed by #17710
Closed

Potential crash when calling ITerminalConnection::WriteInput #17697

j4james opened this issue Aug 10, 2024 · 0 comments · Fixed by #17710
Labels
Area-TerminalConnection Issues pertaining to the terminal<->backend connection interface In-PR This issue has a related PR Issue-Bug It either shouldn't be doing this or needs an investigation. Needs-Tag-Fix Doesn't match tag requirements Priority-3 A description (P3) Product-Terminal The new Windows Terminal.

Comments

@j4james
Copy link
Collaborator

j4james commented Aug 10, 2024

Windows Terminal version

Commit edfa3ea

Windows build number

10.0.19045.4651

Other Software

No response

Steps to reproduce

  1. Patch the DeviceAttributes implementation in adaptDispatch.cpp to respond like this:
    _api.ReturnResponse({L"ABCD", 3});
  2. Open a WSL shell in OpenConsole and execute this:
    printf "\e[c"; read
    
  3. Note that it successfully responds with ABC.
  4. Now try the same thing in a WSL shell from within Windows Terminal.

Expected Behavior

It should also respond successfully with ABC.

Actual Behavior

The terminal crashes.

The ReturnResponse method takes a std::wstring_view, but the Windows Terminal implementation calls ControlCore::_sendInputToConnection, which calls ITerminalConnection::WriteInput, which expects an hstring. When constructing an hstring from a std::wstring_view it's required that the string be null-terminated, otherwise it aborts. And since std::wstring_view is obviously not guaranteed to be null-terminated, this is asking for trouble.

I know the example I've given above is contrived, but that's just because it was the easiest way to demonstrate the problem. There are a number of places in the AdaptDispatch class that are calling ReturnResponse with a fmt::basic_memory_buffer, and that's not guaranteed to be null-terminated. It's just a matter of luck whether that code crashes or not.

@j4james j4james added Issue-Bug It either shouldn't be doing this or needs an investigation. Needs-Triage It's a new issue that the core contributor team needs to triage at the next triage meeting labels Aug 10, 2024
@microsoft-github-policy-service microsoft-github-policy-service bot added the In-PR This issue has a related PR label Aug 13, 2024
@lhecker lhecker added Area-TerminalConnection Issues pertaining to the terminal<->backend connection interface Product-Terminal The new Windows Terminal. Priority-3 A description (P3) and removed Needs-Triage It's a new issue that the core contributor team needs to triage at the next triage meeting labels Aug 13, 2024
DHowett pushed a commit that referenced this issue Aug 14, 2024
`HSTRING` does not permit strings that aren't null-terminated.
As such we'll simply use a plain char array which compiles down to
a `UINT32` and `wchar_t*` pointer pair. Unfortunately, cppwinrt uses
`char16_t` in place of `wchar_t`, and also offers no trivial conversion
between `winrt::array_view` and `std::wstring_view` either.
As such, most of this PR is about explicit type casting.

Closes #17697

## Validation Steps Performed
* Patch the `DeviceAttributes` implementation in `adaptDispatch.cpp`
  to respond like this:
   ```cpp
   _api.ReturnResponse({L"ABCD", 3});
   ```
* Open a WSL shell and execute this:
  ```sh
  printf "\e[c"; read
  ```
* Doesn't crash ✅
@microsoft-github-policy-service microsoft-github-policy-service bot added the Needs-Tag-Fix Doesn't match tag requirements label Aug 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Area-TerminalConnection Issues pertaining to the terminal<->backend connection interface In-PR This issue has a related PR Issue-Bug It either shouldn't be doing this or needs an investigation. Needs-Tag-Fix Doesn't match tag requirements Priority-3 A description (P3) Product-Terminal The new Windows Terminal.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants