Skip to content

Windows template utils.cpp: Use wcsnlen instead of wcslen for defensive programming (CWE-126) #180418

New issue
New issue
Closed
#180419
Closed
Windows template utils.cpp: Use wcsnlen instead of wcslen for defensive programming (CWE-126)#180418
#180419
Labels
P3Issues that are less important to the Flutter projectc: proposalA detailed proposal for a change to Flutterplatform-windowsBuilding on or for Windows specificallyr: fixedIssue is closed as already fixed in a newer versionteam-windowsOwned by the Windows platform teamtoolAffects the "flutter" command-line tool. See also t: labels.triaged-windowsTriaged by the Windows platform team

Description

@dbebawy
dbebawy
opened on Dec 31, 2025

Description

The Windows runner template file packages/flutter_tools/templates/app/windows.tmpl/runner/utils.cpp uses wcslen at line 52, which doesn't handle non-null-terminated strings. While the current usage is safe (input comes from Windows APIs that guarantee null-termination), using wcsnlen would be better defensive programming and resolves security scanner warnings (CWE-126: Buffer Over-read).

Current Code (line 52)

int input_length = (int)wcslen(utf16_string);

Proposed Fix

int input_length = (int)wcsnlen(utf16_string, 32767);

Why This Matters

  1. Security Scanners: Tools like Semgrep/GitLab SAST flag this as HIGH severity (CWE-126)
  2. Defensive Programming: Even though current usage is safe, wcsnlen provides an extra safety bound
  3. No Performance Impact: wcsnlen has negligible overhead for typical string lengths
  4. Consistency: Aligns with Microsoft's secure CRT recommendations

Related

Risk Assessment

LOW - This is a minor defensive improvement. The existing code is functionally correct because:

  • Input strings come from CommandLineToArgvW which guarantees null-termination
  • The null check on line 45 handles the nullptr case

However, the fix follows security best practices and silences legitimate scanner warnings.

Checklist

  • I have read the contributor guide
  • I have an issue that this PR addresses
  • All tests pass locally

Activity

  1. dbebawy
    added 2 commits that reference this issue on Dec 31, 2025

    fix(windows): use wcsnlen for defensive programming (CWE-126)

    9bd81c3

    fix(windows): use wcsnlen for all string operations (CWE-126)

    70f2167
  2. danagbemava-nc
    added
    in triagePresently being triaged by the triage team
    toolAffects the "flutter" command-line tool. See also t: labels.
    platform-windowsBuilding on or for Windows specifically
    c: proposalA detailed proposal for a change to Flutter
    team-windowsOwned by the Windows platform team
    and removed
    in triagePresently being triaged by the triage team
    on Jan 5, 2026
  3. dbebawy
    added 4 commits that reference this issue on Jan 12, 2026

    fix(windows): use wcsnlen for defensive programming (CWE-126)

    2e88d72

    fix(windows): use wcsnlen for all string operations (CWE-126)

    a19f278

    fix(windows): use wcsnlen for defensive programming (CWE-126)

    e9d336d

    fix(windows): use wcsnlen for all string operations (CWE-126)

    9e68b08
  4. loic-sharma
    added
    P3Issues that are less important to the Flutter project
    triaged-windowsTriaged by the Windows platform team
    on Jan 14, 2026
  5. github-merge-queue
    added a commit that references this issue on Jan 16, 2026

    fix(windows): use wcsnlen for defensive programming (CWE-126) (#180419)

    99e01e1
  6. auto-submit
    closed this as completedin #180419on Jan 16, 2026
  7. danagbemava-nc
    added
    r: fixedIssue is closed as already fixed in a newer version
    on Jan 19, 2026
  8. calltekk
    added a commit that references this issue on Jan 19, 2026

    fix(windows): use wcsnlen for defensive programming (CWE-126) (flutte…

    8e6c1ca

  9. github-actions commented on Feb 2, 2026

    @github-actions
    github-actionsBot
    on Feb 2, 2026 – with GitHub Actions

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

  10. github-actions
    locked as resolved and limited conversation to collaborators on Feb 2, 2026
  11. flutter-zl
    added a commit that references this issue on Feb 10, 2026

    fix(windows): use wcsnlen for defensive programming (CWE-126) (flutte…

    2e99cba
  12. Nakiha
    added a commit that references this issue on Sep 28, 2026

    fix(windows): use wcsnlen for defensive programming (CWE-126) (#180419)

    d7469ad
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P3Issues that are less important to the Flutter projectc: proposalA detailed proposal for a change to Flutterplatform-windowsBuilding on or for Windows specificallyr: fixedIssue is closed as already fixed in a newer versionteam-windowsOwned by the Windows platform teamtoolAffects the "flutter" command-line tool. See also t: labels.triaged-windowsTriaged by the Windows platform team

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions