From 720ad055299227b8728bcad734c4e1497f69c595 Mon Sep 17 00:00:00 2001
From: Sascha van Vliet <s.vanvliet@dianafea.com>
Date: Fri, 30 Jul 2021 10:47:08 +0200
Subject: [PATCH] Fix crash in context with wide characters in path

The create_ipc_wildcard_address doesn't takes wide characters
into account while building a string from a temporary path.
The tmpnam_s can return a path in the user temp folder which
can contain special characters.
The string that is returned from the create_ipc_wildcard_address
will be used in the bind routine which will return an error code.
---
 src/ip.cpp | 32 ++++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/src/ip.cpp b/src/ip.cpp
index d150da76..b9accbbe 100644
--- a/src/ip.cpp
+++ b/src/ip.cpp
@@ -868,24 +868,48 @@ void zmq::assert_success_or_recoverable (zmq::fd_t s_, int rc_)
 }
 
 #ifdef ZMQ_HAVE_IPC
+
+#if defined ZMQ_HAVE_WINDOWS
+char *widechar_to_utf8 (const wchar_t *widestring)
+{
+    int nch, n;
+    char *utf8 = 0;
+    nch = WideCharToMultiByte (CP_UTF8, 0, widestring, -1, 0, 0, NULL, NULL);
+    if (nch > 0) {
+        utf8 = (char *)malloc ((nch + 1) * sizeof (char));
+        n = WideCharToMultiByte (CP_UTF8, 0, widestring, -1, utf8,
+                                 nch, NULL, NULL);
+        utf8[nch] = 0;
+    }
+    return utf8;
+}
+#endif
+
 int zmq::create_ipc_wildcard_address (std::string &path_, std::string &file_)
 {
 #if defined ZMQ_HAVE_WINDOWS
-    char buffer[MAX_PATH];
+    wchar_t buffer[MAX_PATH];
 
     {
-        const errno_t rc = tmpnam_s (buffer);
+        const errno_t rc = _wtmpnam_s (buffer);
         errno_assert (rc == 0);
     }
 
     // TODO or use CreateDirectoryA and specify permissions?
-    const int rc = _mkdir (buffer);
+    const int rc = _wmkdir (buffer);
     if (rc != 0) {
         return -1;
     }
 
-    path_.assign (buffer);
+    char* tmp = widechar_to_utf8 (buffer);
+    if (tmp == 0) {
+	return -1;
+    }
+
+    path_.assign (tmp);
     file_ = path_ + "/socket";
+
+    free (tmp);
 #else
     std::string tmp_path;