Check offset before accessing task name property (microsoft#180)

* Check offset before accessing task name property * Update nuspecs
starix · Sep 22, 2021 · ac27477 · ac27477
1 parent 9eb5225
commit ac27477
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 6 deletions.
diff --git a/O365.Security.Native.ETW.Debug.nuspec b/O365.Security.Native.ETW.Debug.nuspec
@@ -11,7 +11,7 @@
         <requireLicenseAcceptance>false</requireLicenseAcceptance>
         <description>Microsoft.O365.Security.Native.ETW Debug is a managed wrapper around the krabsetw ETW library. This is the Debug build.</description>
         <summary>Microsoft.O365.Security.Native.ETW Debug is a managed wrapper around the krabsetw ETW library. This is the Debug build.</summary>
-        <releaseNotes>Do not specify start time when starting trace session.</releaseNotes>
+        <releaseNotes>Do not specify start time when starting trace session. Check offset before accessing task name property.</releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />
         <tags>ETW krabs managed cppcli</tags>

diff --git a/O365.Security.Native.ETW.nuspec b/O365.Security.Native.ETW.nuspec
@@ -11,7 +11,7 @@
         <requireLicenseAcceptance>false</requireLicenseAcceptance>
         <description>Microsoft.O365.Security.Native.ETW is a managed wrapper around the krabsetw ETW library.</description>
         <summary>Microsoft.O365.Security.Native.ETW is a managed wrapper around the krabsetw ETW library.</summary>
-        <releaseNotes>Do not specify start time when starting trace session.</releaseNotes>
+        <releaseNotes>Do not specify start time when starting trace session. Check offset before accessing task name property.</releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />
         <tags>ETW krabs managed cppcli</tags>

diff --git a/krabs/krabs/schema.hpp b/krabs/krabs/schema.hpp
@@ -311,9 +311,14 @@ namespace krabs {
 
     inline const wchar_t *schema::task_name() const
     {
-        return reinterpret_cast<const wchar_t*>(
-            reinterpret_cast<const char*>(pSchema_) +
-            pSchema_->TaskNameOffset);
+        if (pSchema_->TaskNameOffset != 0) {
+            return reinterpret_cast<const wchar_t*>(
+                reinterpret_cast<const char*>(pSchema_) +
+                pSchema_->TaskNameOffset);
+        }
+        else {
+            return L"";
+        }
     }
 
     inline DECODING_SOURCE schema::decoding_source() const

diff --git a/krabsetw.nuspec b/krabsetw.nuspec
@@ -11,7 +11,7 @@
         <requireLicenseAcceptance>false</requireLicenseAcceptance>
         <description>Krabs ETW provides a modern C++ wrapper around the low-level ETW trace consumption functions</description>
         <summary>Krabs ETW provides a modern C++ wrapper around the low-level ETW trace consumption functions</summary>
-        <releaseNotes>Do not specify start time when starting trace session.</releaseNotes>
+        <releaseNotes>Do not specify start time when starting trace session. Check offset before accessing task name property.</releaseNotes>
         <copyright>© Microsoft Corporation. All rights reserved.</copyright>
         <language />
         <tags>ETW krabs krabsetw native headers cpp</tags>