whitecat1331
d223a49235
## Summary
`PowerRequest::prevent_idle_sleep` passed `PowerCreateRequest` a reason
string whose UTF-16 buffer was dropped when the function returned.
`PowerCreateRequest` documents that the reason pointer must remain valid
for the lifetime of the handle, so the OS was left holding a pointer
into freed memory.
This is a use-after-free (CWE-416), a memory-safety vulnerability. The
reason string is a fixed literal rather than attacker-controlled input,
so the practical exploitability is limited; but it is a genuine
memory-safety defect and should be fixed.
Keep the UTF-16 buffer alive alongside the handle.
## The bug
The reason string is encoded into a local `Vec<u16>`, and a raw pointer
to its heap buffer is handed to `PowerCreateRequest`:
```rust
let mut reason = reason.encode_utf16().chain([0]).collect::<Vec<_>>();
let context = REASON_CONTEXT {
// ...
Reason: REASON_CONTEXT_0 {
SimpleReasonString: PWSTR(reason.as_mut_ptr()),
},
};
let handle = unsafe { PowerCreateRequest(&context) }?;
// ...
Ok(Self { handle }) // `reason` dropped here, freeing the buffer the handle points into
```
The pointer crosses an `unsafe` FFI boundary, so the borrow checker
cannot see that Windows retains it. When `prevent_idle_sleep` returns,
`reason` is dropped and its buffer freed while the handle still refers
to it.
## The fix
Move the UTF-16 buffer into the struct so it lives as long as the
handle:
```rust
struct PowerRequest {
handle: HANDLE,
_reason: Vec<u16>,
}
// ...
Ok(Self { handle, _reason: reason })
```
`Drop` closes the handle before fields are dropped, so the buffer is
freed only after the OS stops referencing it.
Release Notes:
- Fixed a use-after-free in Windows idle-sleep prevention that could
read freed memory.
Zed
Welcome to Zed, a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.
Installation
On macOS, Linux, and Windows you can download Zed directly or install Zed via your local package manager (macOS/Linux/Windows).
Other platforms are not yet available:
- Web (tracking discussion)
Developing Zed
Contributing
See CONTRIBUTING.md for ways you can contribute to Zed.
Also... we're hiring! Check out our jobs page for open roles.
Licensing
Zed source code is licensed primarily under GPL-3.0-or-later, with Apache-2.0 components where marked.
License information for third party dependencies must be correctly provided for CI to pass.
We use cargo-about to automatically comply with open source licenses. If CI is failing, check the following:
- Is it showing a
no license specifiederror for a crate you've created? If so, addpublish = falseunder[package]in your crate's Cargo.toml. - Is the error
failed to satisfy license requirementsfor a dependency? If so, first determine what license the project has and whether this system is sufficient to comply with this license's requirements. If you're unsure, ask a lawyer. Once you've verified that this system is acceptable add the license's SPDX identifier to theacceptedarray inscript/licenses/zed-licenses.toml. - Is
cargo-aboutunable to find the license for a dependency? If so, add a clarification field at the end ofscript/licenses/zed-licenses.toml, as specified in the cargo-about book.
Sponsorship
Zed is developed by Zed Industries, Inc., a for-profit company.
If you’d like to financially support the project, you can do so via GitHub Sponsors. Sponsorships go directly to Zed Industries and are used as general company revenue. There are no perks or entitlements associated with sponsorship.