Bug
junction_point builds an NT-style substitute path via encode_wide() on the target without an early interior-NUL check on the original / absolute path. An embedded NUL would truncate the reparse substitute name written to the mount-point buffer.
Origin
Reparse helper constructs wide buffers directly; related junction fixes (#548/#549) address buffer/rollback but not this input class. Sibling: #542 Windows chdir NUL.
Impact
Untrusted junction targets could produce wrong or truncated reparse targets (path confusion / incomplete links).
Fix
Reject path_bytes / resolved absolute bytes containing 0 with InvalidInput, consistent with to_u16s / absolute() verbatim checks.
Bug
junction_pointbuilds an NT-style substitute path viaencode_wide()on the target without an early interior-NUL check on the original / absolute path. An embedded NUL would truncate the reparse substitute name written to the mount-point buffer.Origin
Reparse helper constructs wide buffers directly; related junction fixes (#548/#549) address buffer/rollback but not this input class. Sibling: #542 Windows chdir NUL.
Impact
Untrusted junction targets could produce wrong or truncated reparse targets (path confusion / incomplete links).
Fix
Reject
path_bytes/ resolved absolute bytes containing0withInvalidInput, consistent withto_u16s/absolute()verbatim checks.