diff options
| author | bors <bors@rust-lang.org> | 2024-09-04 15:07:06 +0000 |
|---|---|---|
| committer | bors <bors@rust-lang.org> | 2024-09-04 15:07:06 +0000 |
| commit | eeb90cda1969383f56a2637cbd3037bdf598841c (patch) | |
| tree | 54fd52367088ebbf0c73f13e278d8047fb723aba /library/std/src/sys/pal | |
| parent | f54dd915b0a4345ee06fd561416ad1af08b54dbb (diff) | |
| parent | b666f820546ad2fd15b591acc8dfd7e7f461147e (diff) | |
| download | rust-1.81.0.tar.gz rust-1.81.0.zip | |
Auto merge of #129960 - pietroalbini:pa-cve-2024-43402, r=pietroalbini 1.81.0
[stable] Fix CVE-2024-43402 Backport the fix for CVE-2024-43402 in the upcoming 1.81.0. See https://github.com/rust-lang/rust/security/advisories/GHSA-2xg3-7mm6-98jj for more information about it. This also includes https://github.com/rust-lang/rust/pull/129944 as a last-minute fix to the relnotes. cc `@boxyuwu` as you are driving this release r? `@ghost`
Diffstat (limited to 'library/std/src/sys/pal')
| -rw-r--r-- | library/std/src/sys/pal/windows/mod.rs | 2 | ||||
| -rw-r--r-- | library/std/src/sys/pal/windows/process.rs | 23 |
2 files changed, 19 insertions, 6 deletions
diff --git a/library/std/src/sys/pal/windows/mod.rs b/library/std/src/sys/pal/windows/mod.rs index b85a8318bcb..aab36f53612 100644 --- a/library/std/src/sys/pal/windows/mod.rs +++ b/library/std/src/sys/pal/windows/mod.rs @@ -14,7 +14,7 @@ pub use self::rand::hashmap_random_keys; #[macro_use] pub mod compat; -mod api; +pub mod api; pub mod alloc; pub mod args; diff --git a/library/std/src/sys/pal/windows/process.rs b/library/std/src/sys/pal/windows/process.rs index 76d2cb77d47..c816cb81097 100644 --- a/library/std/src/sys/pal/windows/process.rs +++ b/library/std/src/sys/pal/windows/process.rs @@ -279,11 +279,24 @@ impl Command { None }; let program = resolve_exe(&self.program, || env::var_os("PATH"), child_paths)?; - // Case insensitive "ends_with" of UTF-16 encoded ".bat" or ".cmd" - let is_batch_file = matches!( - program.len().checked_sub(5).and_then(|i| program.get(i..)), - Some([46, 98 | 66, 97 | 65, 116 | 84, 0] | [46, 99 | 67, 109 | 77, 100 | 68, 0]) - ); + let has_bat_extension = |program: &[u16]| { + matches!( + // Case insensitive "ends_with" of UTF-16 encoded ".bat" or ".cmd" + program.len().checked_sub(4).and_then(|i| program.get(i..)), + Some([46, 98 | 66, 97 | 65, 116 | 84] | [46, 99 | 67, 109 | 77, 100 | 68]) + ) + }; + let is_batch_file = if path::is_verbatim(&program) { + has_bat_extension(&program[..program.len() - 1]) + } else { + super::fill_utf16_buf( + |buffer, size| unsafe { + // resolve the path so we can test the final file name. + c::GetFullPathNameW(program.as_ptr(), size, buffer, ptr::null_mut()) + }, + |program| has_bat_extension(program), + )? + }; let (program, mut cmd_str) = if is_batch_file { ( command_prompt()?, |