Commit be9471985783641f0af2a6aa0aa61294d139563e
2021-10-20T17:33:34
avoid reading past end of stack array in GetEnvironmentVar I ran into a case where GetEnvironmentVariableA returned a nonzero value, but std::string() read past the end of the oldValue array when it tried to strlen() it. It seems it tried to read an environment variable that was already huge, because MSDN says: If lpBuffer is not large enough to hold the data, the return value is the buffer size, in characters, required to hold the string and its terminating null character and the contents of lpBuffer are undefined. So if the buffer isn't large enough, it doesn't just truncate the value (like GetModuleFilenameA would). It instead returns the size we would need to allocate to store the value. It also vaguely states that the contents of the buffer are undefined in this scenario, which means that the std::array used here could still be filled with uninitialized data without a null character in there. A better solution here is to use a FastVector, so we can resize it to fit whatever variable we're reading (MSDN states the maximum environment variable size is 32,767 characters, including the null terminator -- not MAX_PATH as this code seems to have assumed). Bug: angleproject:6600 Change-Id: I1582867578c5b879e71d58ab494a5134848b180f Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3235902 Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Reviewed-by: Jamie Madill <jmadill@chromium.org> Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>