Guard the CurrentUnixTime global, so Security and JsonWebToken can be used together - #5
Open
mckuipers wants to merge 4 commits into
Conversation
BCryptDuplicateHash and BCryptDuplicateKey fetched BCRYPT_PROVIDER_HANDLE via BCryptNamedUIntegerPropertyValue, which only accepts 4-byte values. BCRYPT_PROVIDER_HANDLE is a native Handle, 8 bytes on x64, so the size check silently returned 0 and the next BCryptGetProperty call dereferenced a null handle. Both call sites now fetch the handle via raw BCryptNamedPropertyValue and copy it in only when the returned size matches SizeOfType(Handle). BCryptGetProperty's blanket 8-to-4 truncation is removed since it was corrupting the newly fetched 8-byte handle. The same tolerance is re-added scoped to BCryptNamedUIntegerPropertyValue, the one caller that legitimately wants 4 bytes. NCryptNamedUIntegerPropertyValue gets the same tolerance for symmetry, though it has no current callers.
…ge-manager Fix BCRYPT_PROVIDER_HANDLE access violation in CNG.pkg
include/UnixTime.pkg guards its other five definitions - gVoid, tFileTime,
tSystemTime, and the two External_Functions - but `Function CurrentUnixTime
Global` had no #IFNDEF around it.
That makes the library uncombinable with DataFlex-dev/JsonWebToken, which
ships a byte-identical copy of this file as JWT/UnixTime.pkg, also
unguarded. DataFlex resolves a Use by path, so to the compiler these are two
unrelated files and the global is defined twice:
Error 4390: Illegal method name definition
Global method GET CURRENTUNIXTIME already defined
Reproduce by building any program that uses cSecureOneTimePassword (TOTP)
and JWT together - which is what the OAuth Server Lib needs, since it
requires JsonWebToken and any OIDC provider offering a second factor wants
both.
Get_CurrentUnixTime is the symbol a `Function ... Global` defines; the
precedent is DataFlex's own cWorkspace.pkg, which guards `Function
LastDelimeter Global` with `#IFDEF Get_LastDelimeter`. Verified by
compiling this file into a program that already defines CurrentUnixTime:
4390 before, clean after.
Guarding either copy is enough to fix the collision, but both should have
one so neither depends on Use order.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
include/UnixTime.pkgguards its other five definitions —gVoid,tFileTime,tSystemTime,and both
External_Functions — butFunction CurrentUnixTime Globalhas no#IFNDEFaroundit. This adds the missing one.
Why it matters
DataFlex-dev/JsonWebTokenships a byte-identical copy of this file asJWT/UnixTime.pkg,also unguarded. DataFlex resolves a
Useby path, so to the compiler these are two unrelatedfiles, and any program containing both gets the global twice:
That combination is not exotic — it is what the OAuth Server Lib needs. OAuth Server Lib
requires JsonWebToken, and any OIDC provider offering TOTP as a second factor also wants
cSecureOneTimePasswordfrom this library. The first build that puts TOTP and JWT in oneprogram fails, and the error points into a package-manager-installed folder that cannot be
edited, so it reads like a broken dependency rather than a name collision.
Reproduce
Build any program that uses
cSecureOneTimePasswordandJWT.pkgtogether.Why
Get_CurrentUnixTimeis the right symbolA
Function <Name> GlobaldefinesGet_<Name>. The precedent is DataFlex's owncWorkspace.pkg, which guardsFunction LastDelimeter Globalwith#IFDEF Get_LastDelimeter.I used this file's existing
#IFNDEF … #ENDIFstyle rather thancWorkspace.pkg's#IFDEF … #ELSE … #ENDIF, to match the five guards already here.Verification
Compiled this patched file into a program that already defines
CurrentUnixTime:Error 4390atUnixTime.pkg (40,1).The same build also asserts the symbol name is right rather than assuming it, via
placed after a known definition. Neither
#ERRORfires — the second one is there so the firstcannot pass vacuously.
The matching PR on JsonWebToken
Guarding either copy fixes the collision, but both should have one so neither library depends
on
Useorder. The matching one-line PR is going up onDataFlex-dev/JsonWebTokenas well.Base branch
Raised against
26-0-package-manager. This file is the identical blob onproduction/stable,and the commit cherry-picks there cleanly — verified — so it can land on either.