Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Saturday, 03-Feb-2024 11:05:48 JST Rich Felker

   in reply to

   • Marcus Hutchins :verified:
   • Jesse Emond

   @JesseEmond @malwaretech TCHAR is this hideous Windows thing that expands to CHAR or WCHAR (which isn't a conformant wchar_t but UTF-16) depending on whether you setup your build parameters to "Unicode" or "ANSI".

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Jesse Emond (jesseemond@infosec.exchange)'s status on Saturday, 03-Feb-2024 11:05:52 JST Jesse Emond

     in reply to

     • Marcus Hutchins :verified:

     @malwaretech @dalias oh I got confused by what I found for the definition of "TCHAR", I thought it was typedeffed to 'char', nevermind. Thanks!

   • Embed this notice
     Marcus Hutchins :verified: (malwaretech@infosec.exchange)'s status on Saturday, 03-Feb-2024 11:05:53 JST Marcus Hutchins :verified:

     in reply to

     • Jesse Emond

     @JesseEmond @dalias wchars are 2 bytes each

   • Embed this notice
     Jesse Emond (jesseemond@infosec.exchange)'s status on Saturday, 03-Feb-2024 11:05:55 JST Jesse Emond

     in reply to

     • Marcus Hutchins :verified:

     @malwaretech @dalias I'm sure I'm just misreading the doc, but doesn't it say that pcchString will get the length in "TCHARs" i.e. chars? So why would dwLength not be in # of bytes in this case?

   • Embed this notice
     Marcus Hutchins :verified: (malwaretech@infosec.exchange)'s status on Saturday, 03-Feb-2024 11:05:56 JST Marcus Hutchins :verified:

     in reply to

     @dalias We have a winner.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 03-Feb-2024 11:05:57 JST Rich Felker

     in reply to

     • Marcus Hutchins :verified:

     @malwaretech I would assume length is in characters (or rather UTF-16 code units since this is some Windows hell), not bytes...

   • Embed this notice
     Marcus Hutchins :verified: (malwaretech@infosec.exchange)'s status on Saturday, 03-Feb-2024 11:05:58 JST Marcus Hutchins :verified:

     I asked ChatGPT to generate C code to covert a string to base64. Who can spot the vulnerability?

     (Posted this on LinkedIn but still nobody has found it yet).