Skip to content

Commit

Permalink
Fix from Jurriaan Bremer: use CallNamedPipeW instead of CallNamedPipe…
Browse files Browse the repository at this point in the history
… lest we clobber the per-thread storage for unicode string storage on callers to pipe() or pipe2(). This could change application behavior or result in easy detection of cuckoomon.
  • Loading branch information
brad-sp committed May 8, 2015
1 parent 27b087a commit dff5ec8
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 6 deletions.
7 changes: 4 additions & 3 deletions config.c
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ int read_config(void)
char buf[512], config_fname[MAX_PATH];
FILE *fp;
unsigned int i;
unsigned int vallen;

sprintf(config_fname, "C:\\%u.ini", GetCurrentProcessId());

Expand All @@ -53,10 +54,10 @@ int read_config(void)
const char *key = buf, *value = p + 1;

*p = 0;

vallen = strlen(value);
if(!strcmp(key, "pipe")) {
strncpy(g_config.pipe_name, value,
ARRAYSIZE(g_config.pipe_name));
for (i = 0; i < vallen; i++)
g_config.pipe_name[i] = (wchar_t)(unsigned short)value[i];
}
else if (!strcmp(key, "logserver")) {
strncpy(g_config.logserver, value,
Expand Down
2 changes: 1 addition & 1 deletion config.h
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.

struct _g_config {
// name of the pipe to communicate with cuckoo
char pipe_name[MAX_PATH];
wchar_t pipe_name[MAX_PATH];

char logserver[MAX_PATH];

Expand Down
4 changes: 2 additions & 2 deletions pipe.c
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ int pipe(const char *fmt, ...)
ret = 0;
}
#else
if (CallNamedPipe(g_config.pipe_name, buf, len, buf, len,
if (CallNamedPipeW(g_config.pipe_name, buf, len, buf, len,
(unsigned long *)&len, NMPWAIT_WAIT_FOREVER) != 0)
ret = 0;
#endif
Expand All @@ -213,7 +213,7 @@ int pipe2(void *out, int *outlen, const char *fmt, ...)
_pipe_sprintf(buf, fmt, args);
va_end(args);

if(CallNamedPipe(g_config.pipe_name, buf, len, out, *outlen,
if(CallNamedPipeW(g_config.pipe_name, buf, len, out, *outlen,
(DWORD *) outlen, NMPWAIT_WAIT_FOREVER) != 0)
ret = 0;
free(buf);
Expand Down

0 comments on commit dff5ec8

Please sign in to comment.