dilim/git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2026-08-04 23:21:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'js/wincred-fixes'

Browse Source 
The wincred credential helper has been updated to avoid memory
corruption when erasing credentials and to prevent silent
credential loss when storing OAuth tokens, by correcting buffer
allocations and arguments passed to safe-CRT APIs.

* js/wincred-fixes:
  wincred: prevent silent credential loss when storing OAuth tokens
  wincred: avoid memory corruption when erasing a credential
This commit is contained in:
Junio C Hamano
2026-07-16 23:05:46 -07:00
parent 44de1520f0 f635ab9ab4
commit 62c9cec696
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
contrib/credential/wincred/git-credential-wincred.c
View File

@@ -121,10 +121,10 @@ static int match_part_last(LPCWSTR *ptarget, LPCWSTR want, LPCWSTR delim)
static int match_cred_password(const CREDENTIALW *cred) {
int ret;
WCHAR *cred_password = xmalloc(cred->CredentialBlobSize);
wcsncpy_s(cred_password, cred->CredentialBlobSize,
(LPCWSTR)cred->CredentialBlob,
cred->CredentialBlobSize / sizeof(WCHAR));
size_t wlen = cred->CredentialBlobSize / sizeof(WCHAR);
WCHAR *cred_password = xmalloc((wlen + 1) * sizeof(WCHAR));
wcsncpy_s(cred_password, wlen + 1,
(LPCWSTR)cred->CredentialBlob, wlen);
ret = !wcscmp(cred_password, password);
free(cred_password);
return ret;
@@ -208,8 +208,8 @@ static void store_credential(void)
if (oauth_refresh_token) {
wlen = _scwprintf(L"%s\r\noauth_refresh_token=%s", password, oauth_refresh_token);
secret = xmalloc(sizeof(WCHAR) * wlen);
_snwprintf_s(secret, sizeof(WCHAR) * wlen, wlen, L"%s\r\noauth_refresh_token=%s", password, oauth_refresh_token);
secret = xmalloc((wlen + 1) * sizeof(WCHAR));
_snwprintf_s(secret, wlen + 1, wlen, L"%s\r\noauth_refresh_token=%s", password, oauth_refresh_token);
} else {
secret = _wcsdup(password);
}