wincred: avoid memory corruption when erasing a credential

The earlier d22a488482 (wincred: avoid memory corruption, 2025-11-17)
repaired only get_credential(); match_cred_password() has the same
defect and is reached on `git credential reject`. When Git asks the
helper to erase a stored credential whose password was supplied by
the caller, the helper copies the candidate's password into a freshly
allocated buffer for comparison. That copy overruns the allocation
by one WCHAR of NUL, which on uninstrumented Windows manifests as
process termination with status 0xC0000374. Because the helper can
die before reaching CredDeleteW(), `git credential reject` masks the
failure and the rejected credential remains stored.

CredentialBlobSize is documented as a byte count, so for an N-WCHAR
blob it equals N * sizeof(WCHAR). The pre-fix code allocated that
many bytes and asked wcsncpy_s to copy N wide characters, but
wcsncpy_s always appends a terminating NUL WCHAR, writing one WCHAR
past the allocation. The destination-capacity argument was also
passed in bytes rather than in WCHAR elements as the API requires,
so the safe-CRT runtime never rejected the copy.

See GHSA-rxqw-wxqg-g7hw.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/contrib/credential/wincred/git-credential-wincred.c b/contrib/credential/wincred/git-credential-wincred.c
index 73c2b9b72ab53ecd9613276af598d12ce54262cf..190bbccdf9e84c020f6e014225090a8f4e9be504 100644 (file)
--- a/contrib/credential/wincred/git-credential-wincred.c
+++ b/contrib/credential/wincred/git-credential-wincred.c
@@ -121,10 +121,10 @@ static int match_part_last(LPCWSTR *ptarget, LPCWSTR want, LPCWSTR delim)
 
 static int match_cred_password(const CREDENTIALW *cred) {
        int ret;
-       WCHAR *cred_password = xmalloc(cred->CredentialBlobSize);
-       wcsncpy_s(cred_password, cred->CredentialBlobSize,
-               (LPCWSTR)cred->CredentialBlob,
-               cred->CredentialBlobSize / sizeof(WCHAR));
+       size_t wlen = cred->CredentialBlobSize / sizeof(WCHAR);
+       WCHAR *cred_password = xmalloc((wlen + 1) * sizeof(WCHAR));
+       wcsncpy_s(cred_password, wlen + 1,
+               (LPCWSTR)cred->CredentialBlob, wlen);
        ret = !wcscmp(cred_password, password);
        free(cred_password);
        return ret;