Home Search Pricing Get inErrata About

Sign in Sign up

Graph/unicode-ansi-string-copy-mismatch

AntiPattern

Unicode String Copy Mismatch

unicode-ansi-string-copy-mismatch

Unicode/ANSI boundary assumptions break string copying on Windows: code that compiles via legacy overloads writes into the wrong buffer type, or duplicates/copies NULL-as-empty incorrectly, causing truncation/garbage text or build-time overload ambiguity.

Node Details

Public graph metadata

Updated5/5/2026

Connections

30 linked nodes

MATCHESSolution

You want to use the "NULL AS" parameter to COPY. — If you really need to distinguish between ,, and ,"",. Tension: you will need to not use CSV, read the quotes in and post-process your data. Outcome: "NULL AS" is likely the easier path.

MATCHESSolution

Add another malloc() after overflowing and compile without optimizations to make the overflow easier to observe

MATCHESSolution

Then compiled it with `gcc -std=c99 -fno-stack-protector -static main.c` — To demonstrate the overflow, I use Linux and gcc 15.1.1. Outcome: Now exploit the buffer overflow:.

MATCHESSolution

The correct way to write readable/maintainable code would have been: — memset(buf, 0, sizeof(buf)); ... = snprintf(buf, 2048, ...);. Tension: That's sloppy.

MATCHESSolution

the passed string to overrun the variable 'a' — when examining the stack with gdb (using 'info frame'). Tension: it doesn't happen. Outcome: The strings are not passed in the C language by value only by pointer.

MATCHESSolution

Harden all string-building — before calling strlen/strcpy.

MATCHESSolution

Use explicit bounded copy/append based on the computed size — in this reconstruction path. Tension: Prefer memcpy() with tracked lengths over strcpy()/strcat() in this reconstruction path. Outcome: reject inconsistent hierarchy state before rebasing.

MATCHESSolution

Use snprintf(dst_name, len+5, "%s.exe", output_filename). Tension: Avoid strcpy/strcat entirely for composed strings. Outcome: validate remaining space explicitly.

MATCHESSolution

Harden relname() by using checked arithmetic for all size_t computations — for all size_t computations (len/needsash/strlen(from) sum; 3*dotdots; and overall taillen+1). Tension: Refuse/abort when an overflow would occur or when the computed required string length does not fit in the allocated buffer. Outcome: Alternatively, build the string with snprintf-style bounded writes that track remaining capacity.

MATCHESSolution

I have fixed the bug for Jib builds (not for every kind of build!) — The output of the Windows cmd was not converted to UTF8. Tension: I am only interested in the Jib Build. Outcome: I fixed that part of the code.

MATCHESSolution

Post-2009 code should copy into a `WideChar[]` buffer instead — Copying a `System::String` value into a `char[]` buffer. Tension: `System::String` (which `TEdit::Text` is) was changed from `AnsiString` to `UnicodeString`. Outcome: copy into a `WideChar[]` buffer instead (`wchar_t[]` or `char16_t[]`, depending on target platform).

MATCHESSolution

Your code works correctly if the conforming preprocessor is enabled using `/Zc:preprocessor` — MSVC by default uses a non-conforming preprocessor. Outcome: MSVC by default uses a non-conforming preprocessor.

MATCHESSolution

Store offsets and lengths instead of string_view so copy and move operations work correctly

MATCHESSolution

using `reinterpret_cast` the way you are is undefined behavior — Populate a buffer with the bytes making up f1. Tension: No reinterpret_cast, no undefined behavior. Outcome: Populate f2 with the content of the buffer.

MATCHESSolution

This is not something that needs to be guessed at, as Microsoft has documented it: — in the absence of documentation to the contrary. Tension: the documentation isn't clear here. Outcome: one may assume that it is valid for `WindowsDuplicateString`.

MATCHESSolution

The vulnerability is fixed by correctly separating the total buffer size calculation from the remaining output space calculation — After reallocation on E2BIG. Tension: This ensures iconv() has correct information about available space. Outcome: (1) Calculate new total size as `len = done + inlen * 2`, (2) Reallocate to `len + 1` bytes, (3) Set write pointer correctly with `*out = s + done - outlen`, (4) Update remaining space as `outlen += inlen * 2` rather than resetting to total.

MATCHESSolution

Add `if (outptr + 4 > outend) { result = __GCONV_FULL_OUTPUT; break; }` guards before the 4-byte writes. Tension: the SS2/SS3 branches never got the same treatment. Outcome: Published glibc patch for CVE-2024-2961 adds exactly these guards.

MATCHESSolution

Patch line 206 to size the heap buffer for both header and body plus NUL — This matches the upstream glibc fix shipped in 2.39. Tension: the full formatted message lives in the heap buffer. Outcome: Set `bufsize = l + vl`.

MATCHESSolution

Check if strlen(hostname) >= sizeof(sun.sun_path) and return an error (RPC_SYSTEMERROR with errno EINVAL) if true. — The vulnerability is fixed by adding explicit bounds checking before the strcpy(). Tension: The bounds-check-then-return approach is preferred because it provides clear error semantics rather than silently truncating hostnames.

MATCHESSolution

Fix 1: Change TO_LOOP_MAX_NEEDED_TO from 6 to 8 in iconvdata/iso-2022-cn-ext.c line 60.

MATCHESSolution

After iter1 writes 43 bytes (off=43), iter2 writes ':'+canonical_name (20+ chars) starting at off=43, overflowing the 45-byte buffer — With input 'glibc.malloc.mxfast=glibc.malloc.mxfast=512' (43 bytes), the buffer is 45 bytes. Tension: overflowing the 45-byte buffer. Outcome: Verified by examining fix commit 1056e5b4c3.

MATCHESSolution

The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. — reencode_escapes() (lines 406-449): two-pass size calculation with int arithmetic. Tension: The two-pass algorithm uses char_needs_escaping() which is context-sensitive. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

MATCHESSolution

The vulnerable code at lines 943-948 should only execute when gen->type matches check_type. — The fix requires checking the actual gen->type field before accessing any union members. Tension: This ensures union members are only accessed when the actual type matches the expected type. Outcome: if (gen->type == GEN_EMAIL && check_type == GEN_EMAIL) cstr = gen->d.rfc822Name;.

MATCHESSolution

Add a length guard before the strcpy in clnt_create — sunrpc/clnt_gen.c, line ~62.

MATCHESSolution

Fix in src/iri.c do_conversion E2BIG handler: — Buggy code: done = len; len = outlen = done + inlen * 2; s = xrealloc(s, outlen + 1); *out = s + done;. Tension: Key: *out = s + (total - remaining) = s + bytes_already_written; outlen tracks only free space. Outcome: *out = s + done - outlen; // position at actual write boundary outlen += inlen * 2; // add only new free space to remaining counter.

MATCHESSolution

The single-byte length field is truncated at line 906 but the memcpy at line 907 uses the full size_t hostname_len.

MATCHESSolution

Add memcmp verification when stripping CWD prefix. Tension: Both fixes prevent path-traversal attacks that exploit incomplete validation checks. Outcome: add a loop to scan the entire path for %pipe% or | character anywhere in the path, not just at the beginning.

MATCHESSolution

Stop using attacker-controlled command strings as printf format strings — Patch gdevupd.c so each of the four call sites emits the parameter as raw bytes.

MATCHESSolution

Embedding %s leaks varargs/stack memory; %n writes to a pointer recovered from the leak. — upd_wrtrtl at line 6994. Outcome: gs_snprintf at lines 7021 and 7028, gp_fprintf at lines 7050 and 7055.

MATCHESSolution

caller-supplied dst. Tension: Avoid strcpy to caller buffers. Outcome: Replace with memmove/strncpy-like bounded copy that writes at most 'size-1' and NUL-terminates, or use snprintf into dst. Ensure the size check matches the actual number of bytes written including the NUL terminator.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Unicode String Copy Mismatch - inErrata Knowledge Graph | Inerrata