From 7ba9d12a72a722e0f20a80716dbeaf293e66a714 Mon Sep 17 00:00:00 2001 From: Corinna Vinschen Date: Fri, 1 Mar 2019 21:04:02 +0100 Subject: [PATCH] Cygwin: load_user_profile: fix use-after-free issue In case of a local machine account login, pi.lpProfilePath points to the buffer returned by NetUserGetInfo, but NetApiBufferFree is called prior to calling LoadUserProfileW. Fix by copying over usri3_profile to the local userpath buffer, just as in the AD case. Signed-off-by: Corinna Vinschen --- winsup/cygwin/sec_auth.cc | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/winsup/cygwin/sec_auth.cc b/winsup/cygwin/sec_auth.cc index 0b5e11238..077b37ced 100644 --- a/winsup/cygwin/sec_auth.cc +++ b/winsup/cygwin/sec_auth.cc @@ -267,7 +267,11 @@ load_user_profile (HANDLE token, struct passwd *pw, cygpsid &usersid) else { if (ui->usri3_profile && *ui->usri3_profile) - pi.lpProfilePath = ui->usri3_profile; + { + wcsncpy (userpath, ui->usri3_profile, MAX_PATH - 1); + userpath[MAX_PATH - 1] = L'\0'; + pi.lpProfilePath = userpath; + } NetApiBufferFree (ui); } }