@samitouri / QOSAMI-WSL-1 / commits / 909d5eb8

Validate NUL-termination of flexible-array Buffer in interop messages (#40402)

* Validate NUL-termination of flexible-array Buffer in interop messages Use string::FromMessageBuffer<T>() instead of directly accessing the Buffer[] flexible-array member in interop message structs. FromMessageBuffer validates that a NUL terminator exists within the span bounds, preventing out-of-bounds reads when a malformed message contains no Buffer data or lacks NUL termination. Affected message handlers: - LxInitMessageQueryEnvironmentVariable (config.cpp) - LxInitMessageCreateLoginSession (config.cpp) - LxMiniInitMessageUnmount (main.cpp) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove unused Message parameter name in WSLC_UNMOUNT handler After switching to FromMessageBuffer, the Message parameter is no longer referenced directly. Remove the name to avoid -Wunused-parameter. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Ben Hillis committed May 4, 2026 at 13:02 UTC 909d5eb85b21958d7231a269dfa89e2da636e4d3

3 files changed +8 -7

src/linux/init/WSLCInit.cpp

+4 -4

@@ -670,13 +670,13 @@ void HandleMessageImpl(

670 Transaction.SendResultMessage(result < 0 ? errno : 0);

671 }

672

673 -void HandleMessageImpl(

674 - wsl::shared::SocketChannel& Channel, wsl::shared::Transaction& Transaction, const WSLC_UNMOUNT& Message, const gsl::span<gsl::byte>& Buffer)

673 +void HandleMessageImpl(wsl::shared::SocketChannel& Channel, wsl::shared::Transaction& Transaction, const WSLC_UNMOUNT&, const gsl::span<gsl::byte>& Buffer)

674 {

676 - auto result = umount(Message.Buffer) < 0 ? errno : 0;

675 + auto* path = wsl::shared::string::FromMessageBuffer<WSLC_UNMOUNT>(Buffer);

676 + auto result = umount(path) < 0 ? errno : 0;

677 if (result == 0)

678 {

679 - result = rmdir(Message.Buffer) < 0 ? errno : 0;

679 + result = rmdir(path) < 0 ? errno : 0;

680 }

681

682 Transaction.SendResultMessage<int32_t>(result);

src/linux/init/config.cpp

+3 -2

@@ -394,7 +394,7 @@ try

394 return;

395 }

396

397 - auto Value = UtilGetEnvironmentVariable(Query->Buffer);

397 + auto Value = UtilGetEnvironmentVariable(wsl::shared::string::FromMessageBuffer<LX_INIT_QUERY_ENVIRONMENT_VARIABLE>(Message));

398 wsl::shared::MessageWriter<LX_INIT_QUERY_ENVIRONMENT_VARIABLE> Response(LxInitMessageQueryEnvironmentVariable);

399 Response.WriteString(Value);

400 Transaction.Send<LX_INIT_QUERY_ENVIRONMENT_VARIABLE>(Response.Span());

@@ -427,7 +427,8 @@ try

427 }

428 else

429 {

430 - success = CreateLoginSession(Config, CreateSession->Buffer, CreateSession->Uid);

430 + success = CreateLoginSession(

431 + Config, wsl::shared::string::FromMessageBuffer<LX_INIT_CREATE_LOGIN_SESSION>(Message), CreateSession->Uid);

432 }

433

434 break;

src/linux/init/main.cpp

+1 -1

@@ -2925,7 +2925,7 @@ Return Value:

2925 return;

2926 }

2927

2928 - Target = GetMountTarget(Message->Buffer);

2928 + Target = GetMountTarget(wsl::shared::string::FromMessageBuffer<LX_MINI_INIT_UNMOUNT_MESSAGE>(Buffer));

2929

2930 Step = LxMiniInitMountStepUnmount;

2931 Result = umount(Target.c_str());