From 0051c582318f02df1fdd69ae496f9e1ed0614ae7 Mon Sep 17 00:00:00 2001 From: Andrea Mazzoleni Date: Thu, 16 Jul 2026 22:39:27 +0200 Subject: [PATCH] Validate WMI-returned VSS snapshot GUID format in mingwapp.c to mitigate potential command injection --- cmdline/mingwapp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/cmdline/mingwapp.c b/cmdline/mingwapp.c index 28a4bace..a17200bf 100644 --- a/cmdline/mingwapp.c +++ b/cmdline/mingwapp.c @@ -541,6 +541,12 @@ int fssnapshot_create(const struct fssnapshot_struct* fss, const char* name) const char* guid = out + 3; + if (windows_guid_is_valid(guid, strlen(guid)) != 0) { + errno = EINVAL; + log_error(errno, "Invalid GUID received from VSS shadow copy creation: '%s'\n", guid); + return -1; + } + /* resolve the shadow copy's device object path */ snprintf(cmd, sizeof(cmd), "(Get-WmiObject Win32_ShadowCopy | Where-Object {$_.ID -eq '%s'}).DeviceObject", guid); if (windows_ps(cmd, device_path, sizeof(device_path)) != 0) {