DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 50A7Ucdk1426493
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E5983385843B
MIME-Version: 1.0
Date: Thu, 09 Jan 2025 23:29:21 -0800
To: cygwin@cygwin.com
Subject: Cygwin main function: vulnerable to wchar_t to char conversion
 attacks or not?
User-Agent: Roundcube Webmail/1.4.15
Message-ID: <2bc465c57c4826ff6eebbd566a92346e@kylheku.com>
From: Kaz Kylheku via Cygwin <cygwin@cygwin.com>
Reply-To: Kaz Kylheku <kaz@kylheku.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

Hi all,

I'm reading an article on attacks that are evidently possible against some Windows
programs in the area of command line parsing. See below.

Does the Cygwin run-time rely on GetCommandLineA to get the char-based command
line that is parsed into argv[]?

If so, it could be vulnerable to attacks which embed Unicode quotes into the
command line, which GetCommandLineA normalizes to ASCII double quotes.

A program which prepares a command line will assiduously escape any double
quotes occurring in the arguments. But if fullwidth Unicode double quotes
occur in the arguments, they will be passed through verbatim, and then
turn into unescaped ASCII double quotes.

Article: https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple