Defense in depth -- the Microsoft way (part 81): enabling UTF-8 support breaks existing code
"Stefan Kanthak" <[email protected]> Fri, 10 Feb 2023 14:22:42 +0100
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq |
|---|---|
| Organization | Me, myself & IT |
| Message-ID | <7DA75DA9B2DA4934B13534AC9CC64E31@H270> |
SGkgQGxsLAoKYWxtb3N0IDQgeWVhcnMgYWdvLCB3aXRoIFdpbmRvd3MgMTAgMTkwMywgYWZ0ZXIg bW9yZSB0aGFuIGEgeWVhcgpiZXRhLXRlc3RpbmcgaW4gaW5zaWRlciBwcmV2aWV3cywgTWljcm9z b2Z0IGZpbmFsbHkgcmVsZWFzZWQgVVRGLTgKc3VwcG9ydCBmb3IgdGhlIC1BIGludGVyZmFjZXMg b2YgdGhlIFdpbmRvd3MgQVBJLgoKMCkgPGh0dHBzOi8vZG9jcy5taWNyb3NvZnQuY29tL2VuLXVz L3dpbmRvd3MvdXdwL2Rlc2lnbi9nbG9iYWxpemluZy91c2UtdXRmOC1jb2RlLXBhZ2UjYWN0aXZl Q29kZVBhZ2U+CgogICB8IElmIHRoZSBBTlNJIGNvZGUgcGFnZSBpcyBjb25maWd1cmVkIGZvciBV VEYtOCwgLUEgQVBJcyB0eXBpY2FsbHkKICAgfCBvcGVyYXRlIGluIFVURi04LiBUaGlzIG1vZGVs IGhhcyB0aGUgYmVuZWZpdCBvZiBzdXBwb3J0aW5nCiAgIHwgZXhpc3RpbmcgY29kZSBidWlsdCB3 aXRoIC1BIEFQSXMgd2l0aG91dCBhbnkgY29kZSBjaGFuZ2VzLgoKICAgVGhlIGxhc3QgY2xhaW0g aXMgYnV0IGEgYmxvb2R5IERBTkdFUk9VUyBsaWUhCiAgIEFzIHNob3duIGhlcmVhZnRlciwgaXQg bXVzdCByZWFkIGluc3RlYWQ6CiAgICJUaGlzIG1vZGVsIGhhcyB0aGUgbWFsZWZpdCBvZiBjYXVz aW5nIGJ1ZmZlciBvdmVycnVucyBpbiBleGlzdGluZwogICAgY29kZSEiCgoKMSkgRm9yIDMwIHll YXJzLCB0aGUgZG9jdW1lbnRhdGlvbiBvZiB0aGUgLUEgaW50ZXJmYWNlcyBmb3IgZmlsZSBhbmQK ICAgZGlyZWN0b3J5IG1hbmFnZW1lbnQgb2YgdGhlIFdpbjMyIEFQSSBzdGF0ZXM6CiAgICJUaGUg bWF4aW11bSBwYXRoIG5hbWUgbGVuZ3RoIGlzIDI2MCBjaGFyYWN0ZXJzLiIKCiAgIFNlZSA8aHR0 cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb20vZW4tdXMvbGlicmFyeS9hYTM2Mzg1NS5hc3B4PgogICAi Q3JlYXRlRGlyZWN0b3J5QSBmdW5jdGlvbiIgZm9yIGV4YW1wbGU6CgogICB8IEZvciB0aGUgQU5T SSB2ZXJzaW9uIG9mIHRoaXMgZnVuY3Rpb24sIHRoZXJlIGlzIGEgZGVmYXVsdCBzdHJpbmcKICAg fCBzaXplIGxpbWl0IGZvciBwYXRocyBvZiAyNDggY2hhcmFjdGVycyAoTUFYX1BBVEggLSBlbm91 Z2ggcm9vbQogICB8IGZvciBhIDguMyBmaWxlbmFtZSkuIC4uLgogICAuLi4KICAgfCBUaGUgMjU1 IGNoYXJhY3RlciBsaW1pdCBwZXIgcGF0aCBzZWdtZW50IHN0aWxsIGFwcGxpZXMuCgogICBUaGlz IGNvbnN0aXR1dGVzIGEgY29udHJhY3R1YWwgR1VBUkFOVEVFIGZvciB0aGUgcHJvZHVjdCBiZWhh dmlvdXIhCgoKMikgVGhlIGRvY3VtZW50YXRpb24gZm9yIHRoZSBmaWxlIHN5c3RlbXMgc3VwcG9y dGVkIGJ5IFdpbmRvd3Mgc2F5cwogICB0b28gIlRoZSBtYXhpbXVtIGxlbmd0aCBvZiBhIGZpbGUg bmFtZSBzZWdtZW50IGlzIDI1NSBjaGFyYWN0ZXJzLiIKICAgU2VlIDxodHRwczovL21zZG4ubWlj cm9zb2Z0LmNvbS9lbi11cy9saWJyYXJ5L2VlNjgxODI3LmFzcHg+CiAgICJGaWxlIFN5c3RlbSBG dW5jdGlvbmFsaXR5IENvbXBhcmlzb24iCgoKMykgV2l0aCB0aGVzZSAyIGNvbnRyYWN0dWFsbHkg R1VBUkFOVEVFRCBwcmVjb25kaXRpb25zLCB0aGUgZm9sbG93aW5nCiAgIGNvZGUgaXMgc2FmZSwg aS5lLiBub3Qgc3VzY2VwdGlibGUgdG8gYSBidWZmZXIgb3ZlcnJ1bjoKICAgQ3JlYXRlRGlyZWN0 b3J5QSgpIGZhaWxzIGFzIHNvb24gYXMgc3pQYXRoIGV4Y2VlZHMgdGhlIGRvY3VtZW50ZWQKICAg bGltaXQgd2hpY2ggaXMgbGVzcyB0aGFuIHRoZSBidWZmZXIgc2l6ZSBvZiAyNjAgY2hhcmFjdGVy cy4KCiAgIENIQVIgc3pBTlNJW10gPSAi4oKsIjsgLy8gb3Igb25lIG9mIHRoZSBmb2xsb3dpbmcg b3RoZXIgMTIyIGNoYXJhY3RlcnMKICAgICAgICAgICAgICAgICAgICAgICAgLy8gZnJvbSBBTlNJ IGNvZGUgcGFnZSAxMjUyOgogICAgICAgICAgICAgICAgICAgICAgICAvLyDigJrGkuKAnuKApuKA oOKAocuG4oCwxaDigLnFksW94oCY4oCZ4oCc4oCd4oCi4oCT4oCUy5zihKLFoeKAusWTxb7FuCDC ocKiwqPCpMKlwqbCp8KowqnCqsKrwqzCrcKuwq/CsMKxwrLCs8K0wrXCtsK3wrjCucK6wrvCvMK9 wr7Cv8OAw4HDggogICAgICAgICAgICAgICAgICAgICAgICAvLyDDg8OEw4XDhsOHw4jDicOKw4vD jMONw47Dj8OQw5HDksOTw5TDlcOWw5fDmMOZw5rDm8Ocw53DnsOfw6DDocOiw6PDpMOlw6bDp8Oo w6nDqsOrw6zDrcOuw6/DsMOxw7LDs8O0w7XDtsO3w7jDucO6w7vDvMO9w77DvwogICBDSEFSIHN6 UGF0aFtNQVhfUEFUSF0gPSAiIjsKICAgZG8KICAgICAgc3RyY2F0KHN6UGF0aCwgc3pBTlNJKTsK ICAgd2hpbGUgKENyZWF0ZURpcmVjdG9yeUEoc3pQYXRoKSk7CgoKNCkgV2l0aCBVVEYtOCBzdXBw b3J0IGVuYWJsZWQsIHRoZSBzYW1lIGNvZGUgbm93IHN1ZmZlcnMgZnJvbSBhCiAgIGJ1ZmZlciBv dmVycnVuOgoKICAgQ0hBUiBzelVURjhbXSA9IHUi4oKsIjsgLy8gb3IgIlx4RTJceDgyXHhBQyIK ICAgQ0hBUiBzelBhdGhbTUFYX1BBVEhdID0gIiI7CiAgIGRvCiAgICAgIHN0cmNhdChzelBhdGgs IHN6VVRGOCk7CiAgIHdoaWxlIChDcmVhdGVEaXJlY3RvcnlBKHN6UGF0aCksIE5VTEwpOwoKICAg U1RSSUtFIDEhCgoKNSkgR2l2ZW4gdGhlIDIgZ3VhcmFudGVlcyBmcm9tIDEpIGFuZCAyKSwgdGhl IGZvbGxvd2luZyBjb2RlIGlzCiAgIGFsc28gc2FmZSBhbmQgbm90IHN1c2NlcHRpYmxlIHRvIGEg YnVmZmVyIG92ZXJydW46IHNlZQogICA8aHR0cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb20vZW4tdXMv bGlicmFyeS9hYTM2NTc0MC5hc3B4PgogICAiV0lOMzJfRklORF9EQVRBQSBzdHJ1Y3R1cmUiIGFu ZCAiRmluZEZpcnN0RmlsZSBmdW5jdGlvbiIKICAgPGh0dHBzOi8vbXNkbi5taWNyb3NvZnQuY29t L2VuLXVzL2xpYnJhcnkvYWEzNjQ0MTguYXNweD4KCiAgIHdmZC5jRmlsZU5hbWUgY2FuIE5FVkVS IHJlY2VpdmUgYSBmaWxlL2RpcmVjdG9yeSBuYW1lIGxvbmdlcgogICB0aGFuIDI1NSBjaGFyYWN0 ZXJzLCBzbyB0aGUgY29uY2F0ZW5hdGlvbiBvZiBDOiBvciAuXCAoYXMKICAgd2VsbCBhcyBDOlwg YW5kIC4uXCB0b28pIGFuZCB3ZmQuY0ZpbGVOYW1lIE5FVkVSIG92ZXJydW5zIGEKICAgYnVmZmVy IG9mIE1BWF9QQVRIIQoKICAgI2RlZmluZSBQQVRURVJOICJDOioiIC8vIG9yICJDOlxcKiIgb3Ig Ii5cXCoiIG9yICIuLlxcKiIKCiAgIFdJTjMyX0ZJTkRfREFUQUEgd2ZkOwogICBDSEFSIHN6UGF0 aFtNQVhfUEFUSF0gPSBQQVRURVJOOwogICBIQU5ETEUgaEZpbmQgPSBGaW5kRmlyc3RGaWxlQShz elBhdGgsICZ3ZmQpOwogICBpZiAoaEZpbmQgIT0gSU5WQUxJRF9IQU5ETEVfVkFMVUUpIHsKICAg ICAgZG8gewogICAgICAgICBzdHJjYXQoc3pQYXRoICsgc3RybGVuKFBBVFRFUk4pIC0gMSwgd2Zk LmNGaWxlTmFtZSk7CiAgICAgICAgIEdldEZpbGVBdHRyaWJ1dGVzQShzelBhdGgpOyAvLyBkbyBz b21ldGhpbmcgd2l0aCB0aGUKICAgICAgICAgLi4uICAgICAgICAgICAgICAgICAgICAgICAgIC8v IGZvdW5kIGZpbGUgc3lzdGVtIG9iamVjdHMKICAgICAgfSB3aGlsZSAoRmluZE5leHRGaWxlKGhG aW5kLCAmd2ZkKSk7CiAgICAgIEZpbmRDbG9zZShoRmluZCk7CiAgIH0KCgo2KSBXaXRoIFVURi04 IHN1cHBvcnQgZW5hYmxlZCBhbmQgYSBmaWxlIG9yIGRpcmVjdG9yeSBuYW1lZAogICDigqzigqzi gqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzi gqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzi gqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzi gqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzigqzi gqzigqzigqzigqzigqzigqzigqzigqwKICAgKG9yIG90aGVyIDg2IGNoYXJhY3RlcnMgZnJvbSB0 aGUgYWJvdmUgMTIzKSBwcmVzZW50IGluIHRoZQogICBDV0Qgb2YgZHJpdmUgQzosIEZpbmRGaXJz dEZpbGVBKCkgKGFuZCBGaW5kTmV4dEZpbGVBKCkgdG9vKQogICByZXR1cm4gYSBzdHJpbmcgb2Yg ODYgKiAzID0gMjU4IGNoYXJhY3RlcnMgaW4gd2ZkLmNGaWxlTmFtZQogICB3aGljaCBjYXVzZXMg YSBidWZmZXIgb3ZlcnJ1biBpbiBwcmV2aW91c2x5IHNhZmUgY29kZSEKCiAgIFNUUklLRSAyIQoK CjcpIFRoZSBmb2xsb3dpbmcgY29kZSBlbnVtZXJhdGVzIEFMTCBmaWxlIHN5c3RlbSBvYmplY3Rz IGluIGEKICAgKHJvb3QpIGRpcmVjdG9yeSBvciBuZXR3b3JrIHNoYXJlOgoKICAgV0lOMzJfRklO RF9EQVRBQSB3ZmQ7CiAgIEhBTkRMRSBoRmluZCA9IEZpbmRGaXJzdEZpbGVBKCJcXFxcaG9zdFxc c2hhcmVcXCoiLCAmd2ZkKTsKICAgaWYgKGhGaW5kICE9IElOVkFMSURfSEFORExFX1ZBTFVFKSB7 CiAgICAgIGRvIHsgLy8gY29kZSB0byBwcm9jZXNzIHdmZC5jRmlsZU5hbWUgb21pdHRlZAogICAg ICB9IHdoaWxlIChGaW5kTmV4dEZpbGUoaEZpbmQsICZ3ZmQpKTsKICAgICAgRmluZENsb3NlKGhG aW5kKTsKICAgfQoKCjgpIFdpdGggVVRGLTggc3VwcG9ydCBlbmFibGVkIGFuZCBhIGRpcmVjdG9y eSBvciBmaWxlIG5hbWVkCiAgIOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKC rOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKC rOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKC rOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKC rOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrOKCrAogICAo aS5lLiA4NyBvciBtb3JlIG9mIHRoZSAxMjMgY2hhcmFjdGVycyBmcm9tIGFib3ZlKSBwcmVzZW50 LAogICBib3RoIEZpbmRGaXJzdEZpbGUoKSBhbmQgRmluZE5leHRGaWxlKCkgRkFJTCB3aXRoIHRo ZQogICBwcmV2aW91c2x5IGltcG9zc2libGUsIE5FVkVSIGVuY291bnRlcmVkIFdpbjMyIGVycm9y IGNvZGUKICAgMjM0IGFsaWFzIEVSUk9SX01PUkVfREFUQTogd2ZkLmNGaWxlTmFtZSBpcyB0byBz aG9ydCBmb3IKICAgVVRGLTggZW5jb2RlZCBmaWxlL2RpcmVjdG9yeSBzZWdtZW50IG5hbWVzIQoK ICAgU1RSSUtFIDMhCgoKc3RheSB0dW5lZCwgYW5kIGZhciBhd2F5IGZyb20gVVRGLTggaW4gV2lu ZG93cwpTdGVmYW4gS2FudGhhawoKUFM6IGZvciB0aGUgZnVsbCBzdG9yeSBvZiBNaWNyb3NvZnQn cyBFUElDIGZhaWx1cmVzIHdpdGggVVRGLTgKICAgIGluIFdpbmRvd3MsIHNlZQogICAgPGh0dHBz Oi8vc2thbnRoYWsuaG9tZXBhZ2UudC1vbmxpbmUuZGUvcXVpcmtzLmh0bWwjcXVpcmszMz4KICAg IDxodHRwczovL3NrYW50aGFrLmhvbWVwYWdlLnQtb25saW5lLmRlL3F1aXJrcy5odG1sI3F1aXJr MzI+CiAgICA8aHR0cHM6Ly9za2FudGhhay5ob21lcGFnZS50LW9ubGluZS5kZS9xdWlya3MuaHRt bCNxdWlyazMxPgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KU2VudCB0aHJvdWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cmh0dHBzOi8v bm1hcC5vcmcvbWFpbG1hbi9saXN0aW5mby9mdWxsZGlzY2xvc3VyZQpXZWIgQXJjaGl2ZXMgJiBS U1M6IGh0dHBzOi8vc2VjbGlzdHMub3JnL2Z1bGxkaXNjbG9zdXJlLw==