X-1.0rc3: Windows: Java_org_sikuli_script_Win32Util_openApp should use SecureZeroMemory

Bug #1101171 reported by Kristian Karl
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
SikuliX
Won't Fix
Medium
RaiMan

Bug Description

In function Java_org_sikuli_script_Win32Util_openApp in file sikuli-script\src\main\native\Win32Util.cc, the usage of ZeroMemory in conjunction with using compiler optimization, can lead to unwanted effects.

For example, I experienced that the function intermittently opened an app in a minimized state. This started to happen on Windows 8, but not on other platforms.

Now, the reason for that, can be that the struct STARTUPINFO is actually not all zeros. Please see article on: https://www.securecoding.cert.org/confluence/display/cplusplus/MSC06-CPP.+Be+aware+of+compiler+optimization+when+dealing+with+sensitive+data

Instead of using ZeroMemory, SecureZeroMemory should be used.

Tags: fkt-app
Revision history for this message
Kristian Karl (kristian-hermann-karl) wrote :
Revision history for this message
RaiMan (raimund-hocke) wrote :

Thanks

Changed in sikuli:
status: New → Fix Committed
assignee: nobody → RaiMan (raimund-hocke)
milestone: none → x1.0
summary: - Use of ZeroMemory in Java_org_sikuli_script_Win32Util_openApp leads to
- intermittent problems
+ X-1.0rc3: Windows: Java_org_sikuli_script_Win32Util_openApp should use
+ SecureZeroMemory
tags: added: windows-native
removed: openapp
RaiMan (raimund-hocke)
tags: added: fkt-app
removed: windows-native
RaiMan (raimund-hocke)
Changed in sikuli:
importance: Undecided → High
RaiMan (raimund-hocke)
Changed in sikuli:
importance: High → Medium
RaiMan (raimund-hocke)
Changed in sikuli:
status: Fix Committed → In Progress
milestone: x1.0 → x1.1
RaiMan (raimund-hocke)
Changed in sikuli:
milestone: 1.1.0 → 1.2.0
RaiMan (raimund-hocke)
Changed in sikuli:
status: In Progress → Won't Fix
milestone: 2.0.0 → none
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.