Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is this a big bug in the implementation of tolower in ntoskrnl.exe?

The following code works fine in user mode:

#include <stdio.h>
#include <ctype.h>

int main()
{
    //
    // 0x7f51 is the unicode code of Chinese character '网'
    //
    int n = tolower(0x7f51); // n will equal 0x7f51
}

However, if we are in kernel mode, n will equal 0x7f71 !!!

The simplest sample code:

#include <ntifs.h>

ULONG NTAPI DriverEntry(PDRIVER_OBJECT, PUNICODE_STRING)
{
    int n = tolower(0x7f51); // n will equal 0x7f71 !!!

    return 0;
}

Is this a big bug in the implementation of tolower in ntoskrnl.exe?

like image 203
xmllmx Avatar asked Nov 22 '13 10:11

xmllmx


1 Answers

tolower(int c) is defined only for integers c, that are EOF or representable as an unsigned char. 0x7f51 is neither. Therefore, the behaviour of tolower(0x7f51) is undefined.

like image 124
Oswald Avatar answered Sep 23 '22 21:09

Oswald