Skip to content

Commit 70d790c

Browse files
authored
[MWB] Fix use after free in service registration (#31633)
* [MWB] Fix use after free in service registration * Update src/modules/MouseWithoutBorders/ModuleInterface/dllmain.cpp --------- Co-authored-by: Andrey Nekrasov <[email protected]>
1 parent eeedbc7 commit 70d790c

File tree

1 file changed

+17
-16
lines changed
  • src/modules/MouseWithoutBorders/ModuleInterface

1 file changed

+17
-16
lines changed

src/modules/MouseWithoutBorders/ModuleInterface/dllmain.cpp

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ class MouseWithoutBorders : public PowertoyModuleIface
198198
Logger::error("Failed to delete MWB service");
199199
return;
200200
}
201-
201+
202202
Trace::MouseWithoutBorders::ToggleServiceRegistration(false);
203203
}
204204

@@ -242,11 +242,10 @@ class MouseWithoutBorders : public PowertoyModuleIface
242242
}
243243

244244
// Pass local app data of the current user to the service
245-
PWSTR cLocalAppPath;
245+
wil::unique_cotaskmem_string cLocalAppPath;
246246
winrt::check_hresult(SHGetKnownFolderPath(FOLDERID_LocalAppData, 0, nullptr, &cLocalAppPath));
247-
CoTaskMemFree(cLocalAppPath);
248247

249-
std::wstring localAppPath{ cLocalAppPath };
248+
std::wstring localAppPath{ cLocalAppPath.get() };
250249
std::wstring binaryWithArgsPath = L"\"";
251250
binaryWithArgsPath += servicePath;
252251
binaryWithArgsPath += L"\" ";
@@ -259,7 +258,8 @@ class MouseWithoutBorders : public PowertoyModuleIface
259258
std::wstring_view existingServicePath{ pServiceConfig->lpBinaryPathName };
260259
alreadyRegistered = true;
261260
isServicePathCorrect = (existingServicePath == binaryWithArgsPath);
262-
if (isServicePathCorrect) {
261+
if (isServicePathCorrect)
262+
{
263263
Logger::warn(L"The service path is not correct. Current: {} Expected: {}", existingServicePath, binaryWithArgsPath);
264264
}
265265

@@ -291,18 +291,19 @@ class MouseWithoutBorders : public PowertoyModuleIface
291291

292292
if (alreadyRegistered)
293293
{
294-
if (!isServicePathCorrect) {
294+
if (!isServicePathCorrect)
295+
{
295296
if (!ChangeServiceConfigW(schService,
296-
SERVICE_NO_CHANGE,
297-
SERVICE_NO_CHANGE,
298-
SERVICE_NO_CHANGE,
299-
binaryWithArgsPath.c_str(),
300-
nullptr,
301-
nullptr,
302-
nullptr,
303-
nullptr,
304-
nullptr,
305-
nullptr))
297+
SERVICE_NO_CHANGE,
298+
SERVICE_NO_CHANGE,
299+
SERVICE_NO_CHANGE,
300+
binaryWithArgsPath.c_str(),
301+
nullptr,
302+
nullptr,
303+
nullptr,
304+
nullptr,
305+
nullptr,
306+
nullptr))
306307
{
307308
Logger::error(L"Failed to update the service's path. ERROR: {}", GetLastError());
308309
}

0 commit comments

Comments
 (0)