Skip to content

Windows junction_point target path does not reject interior NUL before reparse write #591

Description

@SebTardif

Bug

junction_point builds an NT-style substitute path via encode_wide() on the target without an early interior-NUL check on the original / absolute path. An embedded NUL would truncate the reparse substitute name written to the mount-point buffer.

Origin

Reparse helper constructs wide buffers directly; related junction fixes (#548/#549) address buffer/rollback but not this input class. Sibling: #542 Windows chdir NUL.

Impact

Untrusted junction targets could produce wrong or truncated reparse targets (path confusion / incomplete links).

Fix

Reject path_bytes / resolved absolute bytes containing 0 with InvalidInput, consistent with to_u16s / absolute() verbatim checks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions