Commit adbcb1d0 authored by Martin Kreichgauer's avatar Martin Kreichgauer Committed by Commit Bot

fido/win: fix a crash when exclude_list is set in MakeCredential requests

When initializing pExcludeCredentialList parameter of a
WEBAUTHN_MAKE_CREDENTIAL_OPTIONS struct, the code calls std::transform
with a wrong value for the output iterator argument. As a result, the
code crashes if an exclude_list was set in the request. This fixes the
issue by passing the correct output iterator. (The initialization of
the equivalent pAllowCredentialList parameter during GetAssertion was
already correct.)

Bug: 898718
Change-Id: Id0611348f6b4e208d9176d714b10da95b474bd2e
Reviewed-on: https://chromium-review.googlesource.com/c/1374401Reviewed-by: default avatarAdam Langley <agl@chromium.org>
Commit-Queue: Martin Kreichgauer <martinkr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#616035}
parent c6f271ca
...@@ -208,7 +208,8 @@ class WinWebAuthnApiImpl : public WinWebAuthnApi { ...@@ -208,7 +208,8 @@ class WinWebAuthnApiImpl : public WinWebAuthnApi {
ToWinCredentialExVector(exclude_list); ToWinCredentialExVector(exclude_list);
std::vector<WEBAUTHN_CREDENTIAL_EX*> exclude_list_ptrs; std::vector<WEBAUTHN_CREDENTIAL_EX*> exclude_list_ptrs;
std::transform(exclude_list_credentials.begin(), std::transform(exclude_list_credentials.begin(),
exclude_list_credentials.end(), exclude_list_ptrs.begin(), exclude_list_credentials.end(),
std::back_inserter(exclude_list_ptrs),
[](auto& cred) { return &cred; }); [](auto& cred) { return &cred; });
WEBAUTHN_CREDENTIAL_LIST exclude_credential_list{exclude_list_ptrs.size(), WEBAUTHN_CREDENTIAL_LIST exclude_credential_list{exclude_list_ptrs.size(),
exclude_list_ptrs.data()}; exclude_list_ptrs.data()};
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment