fix(process): Solidify env var parsing

rabbitstack · rabbitstack · commit 98dc3662b087 · 2024-10-10T22:41:18.000+02:00
If the env variable contains multiple = symbols,
we make sure the split will always produce two
substrings. When reading the env block, use
the buffer size as the size of the read memory
area.
diff --git a/pkg/ps/peb.go b/pkg/ps/peb.go
@@ -110,7 +110,8 @@ func (p PEB) GetEnvs() map[string]string {
 	}
 	start, end := 0, 0
 	envs := make(map[string]string)
-	s := readUTF16(p.proc, uintptr(p.procParams.Environment), uint32(p.procParams.EnvironmentSize))
+	l := uint32(p.procParams.EnvironmentSize)
+	s := readUTF16(p.proc, uintptr(p.procParams.Environment), l)
 	for i, r := range s {
 		// each env variable key/value pair terminates with the NUL character
 		if r == 0 {
@@ -123,7 +124,7 @@ func (p PEB) GetEnvs() map[string]string {
 				break
 			}
 			env := string(utf16.Decode(s[start:end]))
-			if kv := strings.Split(env, "="); len(kv) == 2 {
+			if kv := strings.SplitN(env, "=", 2); len(kv) == 2 {
 				envs[kv[0]] = kv[1]
 			}
 			start = end + 1
@@ -133,8 +134,8 @@ func (p PEB) GetEnvs() map[string]string {
 }
 
 func readUTF16(proc windows.Handle, addr uintptr, size uint32) []uint16 {
-	b := make([]byte, size*2)
-	err := windows.ReadProcessMemory(proc, addr, &b[0], uintptr(size), nil)
+	b := make([]byte, size*2+1)
+	err := windows.ReadProcessMemory(proc, addr, &b[0], uintptr(len(b)), nil)
 	if err != nil {
 		return nil
 	}

Original file line number	Diff line number	Diff line change
`@@ -110,7 +110,8 @@ func (p PEB) GetEnvs() map[string]string {`
`110`	`110`	`}`
`111`	`111`	`start, end := 0, 0`
`112`	`112`	`envs := make(map[string]string)`
`113`		`- s := readUTF16(p.proc, uintptr(p.procParams.Environment), uint32(p.procParams.EnvironmentSize))`
	`113`	`+ l := uint32(p.procParams.EnvironmentSize)`
	`114`	`+ s := readUTF16(p.proc, uintptr(p.procParams.Environment), l)`
`114`	`115`	`for i, r := range s {`
`115`	`116`	`// each env variable key/value pair terminates with the NUL character`
`116`	`117`	`if r == 0 {`
`@@ -123,7 +124,7 @@ func (p PEB) GetEnvs() map[string]string {`
`123`	`124`	`break`
`124`	`125`	`}`
`125`	`126`	`env := string(utf16.Decode(s[start:end]))`
`126`		`- if kv := strings.Split(env, "="); len(kv) == 2 {`
	`127`	`+ if kv := strings.SplitN(env, "=", 2); len(kv) == 2 {`
`127`	`128`	`envs[kv[0]] = kv[1]`
`128`	`129`	`}`
`129`	`130`	`start = end + 1`
`@@ -133,8 +134,8 @@ func (p PEB) GetEnvs() map[string]string {`
`133`	`134`	`}`
`134`	`135`
`135`	`136`	`func readUTF16(proc windows.Handle, addr uintptr, size uint32) []uint16 {`
`136`		`- b := make([]byte, size*2)`
`137`		`- err := windows.ReadProcessMemory(proc, addr, &b[0], uintptr(size), nil)`
	`137`	`+ b := make([]byte, size*2+1)`
	`138`	`+ err := windows.ReadProcessMemory(proc, addr, &b[0], uintptr(len(b)), nil)`
`138`	`139`	`if err != nil {`
`139`	`140`	`return nil`
`140`	`141`	`}`