Repository navigation
installer: walk the hardware ID list correctly when uninstalling - #153
Draft
eiz-claude wants to merge 1 commit into
Draft
eiz-claude wants to merge 1 commit into
eiz-claude wants to merge 1 commit into
Conversation
RemoveDeviceNode looks for the SAR device among all MEDIA class devices by comparing each entry of its hardware ID list. The loop's bound compared the pointer with itself plus the length (always true), and each step skipped two characters past the end of a string instead of one. Only the first ID of each device was compared correctly, the rest were compared from their second character, and for every device that didn't match, the walk read past the end of the buffer (and kept going while it found non-zero memory there). SAR's own device has a single ID and is matched first, which is why uninstall worked; other audio devices made it read out of bounds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eiz-claude
added this pull request to stack #154
October 3, 2026 15:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RemoveDeviceNode, the uninstall custom action, finds SAR's device by walking each MEDIA-class device's hardware ID list (a REG_MULTI_SZ). The walk had two bugs:Only the first ID of each device was compared correctly; later ones were compared from their second character. For every device that didn't match, the walk read past the end of the buffer, and kept going while the memory there wasn't zero. SAR's own device has a single hardware ID and is matched on the first comparison, which is why uninstall works in practice. Any other audio device on the machine made the action read out of bounds.
The fix bounds the loop by the buffer and steps one character past each string.
Tested
Found by reading the code. The out-of-bounds read can't be reproduced on the test VM: it has no other MEDIA devices, and a short overread doesn't fault anyway. I checked this branch's MSI on the VM: install and uninstall both exit 0,
RemoveDeviceNodereturns success, and the SAR device node, driver service, ASIO registrations and files are all gone after uninstall. The full rig suite also passes on this branch.🤖 Generated with Claude Code