1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/tracing/common/system_log_event_utils_win.h"
#include <windows.h>
#include "base/containers/span.h"
namespace {
template <class CharT>
std::optional<std::basic_string<CharT>> CopyBasicString(
base::BufferIterator<const uint8_t>& iterator) {
auto before = iterator;
// Advance `iterator` forward until a terminator is found.
while (true) {
// Use `CopyObject()` to avoid unaligned reads for multi-byte char strings.
auto optional_char = iterator.CopyObject<CharT>();
if (!optional_char.has_value()) { // Premature end of data.
iterator.Seek(before.position()); // Rewind.
return std::nullopt;
}
if (!*optional_char) {
break; // String terminator found.
}
}
// Compute the string length, in chars, excluding the terminator.
auto size = (iterator.position() - before.position()) / sizeof(CharT) - 1;
return std::basic_string<CharT>(
base::as_string_view(before.Span<CharT>(size)));
}
} // namespace
namespace tracing {
std::optional<std::string> CopyString(
base::BufferIterator<const uint8_t>& iterator) {
return CopyBasicString<char>(iterator);
}
std::optional<std::wstring> CopyWString(
base::BufferIterator<const uint8_t>& iterator) {
return CopyBasicString<wchar_t>(iterator);
}
std::optional<base::win::Sid> CopySid(
size_t pointer_size,
base::BufferIterator<const uint8_t>& iterator) {
// Operate on a copy of the caller's iterator so that the caller's is only
// modified on success.
base::BufferIterator<const uint8_t> temp_iter(iterator);
// Source:
// https://learn.microsoft.com/en-us/windows/win32/etw/event-tracing-mof-qualifiers.
// "If the first 4-bytes (ULONG) of the blob is nonzero, the blob contains a
// SID." If the blob contains a SID, the first two `pointer_size` elements are
// a `TOKEN_USER` struct and the remainder is a `SID` struct. In practice, a
// SID is present even if the first 32-bit int is zero, so ignore its value,
// and skip the `TOKEN_USER` struct (two pointers-sized elements) to reach the
// bytes holding the SID.
if (temp_iter.Object<uint32_t>() == nullptr ||
temp_iter.Span<uint8_t>(2 * pointer_size).empty()) {
return std::nullopt;
}
const auto sid_position = temp_iter.position();
const auto bytes_remaining = temp_iter.total_size() - sid_position;
if (bytes_remaining < 2) {
return std::nullopt;
}
auto remaining_span = temp_iter.Span<uint8_t>(bytes_remaining);
// The second byte in `remaining_span` is the SubAuthorityCount byte. Use it
// to ensure that there is enough data remaining to hold the indicated number
// of subauthorities as per the citation above.
if (bytes_remaining < sizeof(DWORD) * remaining_span[1] + 8) {
return std::nullopt;
}
const SID* sid = reinterpret_cast<const SID*>(remaining_span.data());
if (!::IsValidSid(const_cast<SID*>(sid))) {
return std::nullopt;
}
const auto sid_length = ::GetLengthSid(const_cast<SID*>(sid));
if (sid_length > remaining_span.size()) {
return std::nullopt;
}
// Advance the caller's iterator to just past the sid.
iterator.Seek(sid_position + sid_length);
// Return the SID.
return base::win::Sid::FromPSID(const_cast<SID*>(sid));
}
} // namespace tracing
|
