From 102718c747aaa6c0e9fb2aadcefeee026dbd0086 Mon Sep 17 00:00:00 2001 From: Tamir Suliman Date: Sat, 6 Jun 2026 13:46:33 +0200 Subject: [PATCH] Fix #9 - remove fixed 256-char buffers in ListView population wcscpy_s into a 256-char stack buffer crashes via the invalid parameter handler if a credential ID, fingerprint data, or device info value exceeds 255 characters. FIDO2 credential IDs are binary blobs encoded as hex or base64 and can easily exceed this limit. Dropped the intermediate nameBuffer/valueBuffer in PopulateListView and indexBuffer/dataBuffer in FingerprintDialogProc. Assigned const_cast(str.c_str()) directly to lvItem.pszText instead, which is safe because SendMessage(LVM_INSERTITEM/LVM_SETITEM) is synchronous and copies the text before returning. This is the same pattern already used correctly in PopulatePasskeysList. Fixes #9 --- FIDO2.1 Manager.cpp | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/FIDO2.1 Manager.cpp b/FIDO2.1 Manager.cpp index 2d552e1..3df8cc9 100644 --- a/FIDO2.1 Manager.cpp +++ b/FIDO2.1 Manager.cpp @@ -483,16 +483,12 @@ INT_PTR CALLBACK FingerprintDialogProc(HWND hDlg, UINT message, WPARAM wParam, L lvItem.iItem = static_cast(SendMessage(hListView, LVM_GETITEMCOUNT, 0, 0)); // Add Index to the first column - wchar_t indexBuffer[256]; - wcscpy_s(indexBuffer, index.c_str()); - lvItem.pszText = indexBuffer; + lvItem.pszText = const_cast(index.c_str()); SendMessage(hListView, LVM_INSERTITEM, 0, (LPARAM)&lvItem); // Add Fingerprint ID and Description to the second column lvItem.iSubItem = 1; - wchar_t dataBuffer[256]; - wcscpy_s(dataBuffer, fingerprintID_And_Description.c_str()); - lvItem.pszText = dataBuffer; + lvItem.pszText = const_cast(fingerprintID_And_Description.c_str()); SendMessage(hListView, LVM_SETITEM, 0, (LPARAM)&lvItem); } else { @@ -859,16 +855,12 @@ void PopulateListView(HWND hwnd, const std::wstring& deviceNumber) { lvItem.iItem = static_cast(i); // Add Name - wchar_t nameBuffer[256]; - wcscpy_s(nameBuffer, name.c_str()); - lvItem.pszText = nameBuffer; + lvItem.pszText = const_cast(name.c_str()); SendMessage(hListView, LVM_INSERTITEM, 0, (LPARAM)&lvItem); // Add Value - wchar_t valueBuffer[256]; - wcscpy_s(valueBuffer, value.c_str()); lvItem.iSubItem = 1; - lvItem.pszText = valueBuffer; + lvItem.pszText = const_cast(value.c_str()); SendMessage(hListView, LVM_SETITEM, 0, (LPARAM)&lvItem); }