token2/fido2-manage.cpp
0
0
Fork 0
mirror of https://github.com/token2/fido2-manage.cpp.git synced 2026-06-22 14:42:52 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix #9 - remove fixed 256-char buffers in ListView population

Browse Source 
wcscpy_s into a 256-char stack buffer crashes via the invalid
parameter handler if a credential ID, fingerprint data, or device
info value exceeds 255 characters. FIDO2 credential IDs are binary
blobs encoded as hex or base64 and can easily exceed this limit.

Dropped the intermediate nameBuffer/valueBuffer in PopulateListView
and indexBuffer/dataBuffer in FingerprintDialogProc. Assigned
const_cast<LPWSTR>(str.c_str()) directly to lvItem.pszText instead,
which is safe because SendMessage(LVM_INSERTITEM/LVM_SETITEM) is
synchronous and copies the text before returning. This is the same
pattern already used correctly in PopulatePasskeysList.

Fixes #9
This commit is contained in:
Tamir Suliman
2026-06-06 13:46:33 +02:00
parent 1b6ab4892c
commit 102718c747
1 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FIDO2.1 Manager.cpp
+4 -12
View File
@@ -483,16 +483,12 @@ INT_PTR CALLBACK FingerprintDialogProc(HWND hDlg, UINT message, WPARAM wParam, L
lvItem.iItem = static_cast<int>(SendMessage(hListView, LVM_GETITEMCOUNT, 0, 0));
// Add Index to the first column
wchar_t indexBuffer[256];
wcscpy_s(indexBuffer, index.c_str());
lvItem.pszText = indexBuffer;
lvItem.pszText = const_cast<LPWSTR>(index.c_str());
SendMessage(hListView, LVM_INSERTITEM, 0, (LPARAM)&lvItem);
// Add Fingerprint ID and Description to the second column
lvItem.iSubItem = 1;
wchar_t dataBuffer[256];
wcscpy_s(dataBuffer, fingerprintID_And_Description.c_str());
lvItem.pszText = dataBuffer;
lvItem.pszText = const_cast<LPWSTR>(fingerprintID_And_Description.c_str());
SendMessage(hListView, LVM_SETITEM, 0, (LPARAM)&lvItem);
}
else {
@@ -859,16 +855,12 @@ void PopulateListView(HWND hwnd, const std::wstring& deviceNumber) {
lvItem.iItem = static_cast<int>(i);
// Add Name
wchar_t nameBuffer[256];
wcscpy_s(nameBuffer, name.c_str());
lvItem.pszText = nameBuffer;
lvItem.pszText = const_cast<LPWSTR>(name.c_str());
SendMessage(hListView, LVM_INSERTITEM, 0, (LPARAM)&lvItem);
// Add Value
wchar_t valueBuffer[256];
wcscpy_s(valueBuffer, value.c_str());
lvItem.iSubItem = 1;
lvItem.pszText = valueBuffer;
lvItem.pszText = const_cast<LPWSTR>(value.c_str());
SendMessage(hListView, LVM_SETITEM, 0, (LPARAM)&lvItem);
}