microsoft / microsoft/cppwinrt
Bug: Undefined behavior in param::hstring(std::wstring_view
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.9k
- Forks
- 281
- PR merge metrics
- No merged PRs in 30d
Description
Version
v2.0.250303.1
Summary
The param::hstring constructor that takes a std::wstring_view involves undefined behavior.
A std::wstring_view is not guaranteed to be null-terminated. If it's constructed from a fixed-size buffer, the code from impl::create_hstring_on_stack() will result in UB due to out-of-bounds access:
if (value[length] != 0)
{
abort();
}
In most cases, value[length] will cause a segmentation fault, without reaching the abort() call.
Reproducible example
Expected behavior
No response
Actual behavior
No response
Additional comments
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the param::hstring constructor taking std::wstring_view and follow its call into impl::create_hstring_on_stack(), where the out-of-bounds access is shown. Reproduce the fixed-size-buffer case described in the issue, then verify that the constructor no longer reads beyond the view and add regression coverage for the non-null-terminated input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- backend-api-design
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100