UAF: PCWSTR built from temporary HSTRING in DeviceEnumerator::get_device

[ChrisAmora]

Two call sites build a PCWSTR from a temporary HSTRING. The temporary drops at the ;, so the PCWSTR points at freed heap memory before the Win32 call reads it.

src/api.rs:370 in DeviceEnumerator::get_device:

let w_id = PCWSTR::from_raw(HSTRING::from(device_id).as_ptr());
let immdevice = unsafe { self.enumerator.GetDevice(w_id)? };

src/api.rs:1903 in set_echo_cancellation_render_endpoint:

PCWSTR::from_raw(HSTRING::from(endpoint_id).as_ptr())

Fix, bind the HSTRING so it outlives the FFI call:

let w_id = HSTRING::from(device_id);
let immdevice = unsafe { self.enumerator.GetDevice(&w_id)? };

Symptom we hit: get_device(id) returns success, then Activate(IID_IAudioClient, ...) fails with 0x80070002.

Env: wasapi 0.23.0, windows 0.62.2, Windows 11 26200, rustc stable.

Happy to send a PR.

[HEnquist]

Thanks for reporting! No need for a PR, it's such a small fix. I'll make a new release as soon as I have a little time.