windows: replace all StringToUTF16 calls with UTF16FromString

`StringToUTF16` is deprecated and will panic if given an "invalid"
string (in particular, one that has a null byte in it).  The replacement
function is `UTF16FromString`, and it returns an error if there was
a problem.

This change replaces all uses of `StringToUTF16` with `UTF16FromString`.
The `service` struct now no longer stores a `string` name but rather
a `*uint16` pointer to the name.

It should not be possible to panic due to UTF16 string conversion
at this point.

Fixes golang/go#73006

Change-Id: Idce9cdbb4651fef8481f0cad19b5df0314fd4277
Reviewed-on: https://go-review.googlesource.com/c/sys/+/659936
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Carlos Amedee <carlos@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

windows/svc/mgr/config.go

@@ -121,7 +121,11 @@ func (s *Service) Config() (Config, error) {
 }
 
 func updateDescription(handle windows.Handle, desc string) error {
-	d := windows.SERVICE_DESCRIPTION{Description: toPtr(desc)}
+	descPointer, err := toPtr(desc)
+	if err != nil {
+		return err
+	}
+	d := windows.SERVICE_DESCRIPTION{Description: descPointer}
 	return windows.ChangeServiceConfig2(handle,
 		windows.SERVICE_CONFIG_DESCRIPTION, (*byte)(unsafe.Pointer(&d)))
 }
@@ -141,10 +145,30 @@ func updateStartUp(handle windows.Handle, isDelayed bool) error {
 
 // UpdateConfig updates service s configuration parameters.
 func (s *Service) UpdateConfig(c Config) error {
-	err := windows.ChangeServiceConfig(s.Handle, c.ServiceType, c.StartType,
-		c.ErrorControl, toPtr(c.BinaryPathName), toPtr(c.LoadOrderGroup),
-		nil, toStringBlock(c.Dependencies), toPtr(c.ServiceStartName),
-		toPtr(c.Password), toPtr(c.DisplayName))
+	binaryPathNamePointer, err := toPtr(c.BinaryPathName)
+	if err != nil {
+		return err
+	}
+	loadOrderGroupPointer, err := toPtr(c.LoadOrderGroup)
+	if err != nil {
+		return err
+	}
+	serviceStartNamePointer, err := toPtr(c.ServiceStartName)
+	if err != nil {
+		return err
+	}
+	passwordPointer, err := toPtr(c.Password)
+	if err != nil {
+		return err
+	}
+	displayNamePointer, err := toPtr(c.DisplayName)
+	if err != nil {
+		return err
+	}
+	err = windows.ChangeServiceConfig(s.Handle, c.ServiceType, c.StartType,
+		c.ErrorControl, binaryPathNamePointer, loadOrderGroupPointer,
+		nil, toStringBlock(c.Dependencies), serviceStartNamePointer,
+		passwordPointer, displayNamePointer)
 	if err != nil {
 		return err
 	}

windows/svc/mgr/mgr.go

@@ -34,7 +34,11 @@ func Connect() (*Mgr, error) {
 func ConnectRemote(host string) (*Mgr, error) {
 	var s *uint16
 	if host != "" {
-		s = syscall.StringToUTF16Ptr(host)
+		var err error
+		s, err = syscall.UTF16PtrFromString(host)
+		if err != nil {
+			return nil, err
+		}
 	}
 	h, err := windows.OpenSCManager(s, nil, windows.SC_MANAGER_ALL_ACCESS)
 	if err != nil {
@@ -78,11 +82,11 @@ func (m *Mgr) LockStatus() (*LockStatus, error) {
 	}
 }
 
-func toPtr(s string) *uint16 {
+func toPtr(s string) (*uint16, error) {
 	if len(s) == 0 {
-		return nil
+		return nil, nil
 	}
-	return syscall.StringToUTF16Ptr(s)
+	return syscall.UTF16PtrFromString(s)
 }
 
 // toStringBlock terminates strings in ss with 0, and then
@@ -122,10 +126,34 @@ func (m *Mgr) CreateService(name, exepath string, c Config, args ...string) (*Se
 	for _, v := range args {
 		s += " " + syscall.EscapeArg(v)
 	}
-	h, err := windows.CreateService(m.Handle, toPtr(name), toPtr(c.DisplayName),
+	namePointer, err := toPtr(name)
+	if err != nil {
+		return nil, err
+	}
+	displayNamePointer, err := toPtr(c.DisplayName)
+	if err != nil {
+		return nil, err
+	}
+	sPointer, err := toPtr(s)
+	if err != nil {
+		return nil, err
+	}
+	loadOrderGroupPointer, err := toPtr(c.LoadOrderGroup)
+	if err != nil {
+		return nil, err
+	}
+	serviceStartNamePointer, err := toPtr(c.ServiceStartName)
+	if err != nil {
+		return nil, err
+	}
+	passwordPointer, err := toPtr(c.Password)
+	if err != nil {
+		return nil, err
+	}
+	h, err := windows.CreateService(m.Handle, namePointer, displayNamePointer,
 		windows.SERVICE_ALL_ACCESS, c.ServiceType,
-		c.StartType, c.ErrorControl, toPtr(s), toPtr(c.LoadOrderGroup),
-		nil, toStringBlock(c.Dependencies), toPtr(c.ServiceStartName), toPtr(c.Password))
+		c.StartType, c.ErrorControl, sPointer, loadOrderGroupPointer,
+		nil, toStringBlock(c.Dependencies), serviceStartNamePointer, passwordPointer)
 	if err != nil {
 		return nil, err
 	}
@@ -159,7 +187,12 @@ func (m *Mgr) CreateService(name, exepath string, c Config, args ...string) (*Se
 // OpenService retrieves access to service name, so it can
 // be interrogated and controlled.
 func (m *Mgr) OpenService(name string) (*Service, error) {
-	h, err := windows.OpenService(m.Handle, syscall.StringToUTF16Ptr(name), windows.SERVICE_ALL_ACCESS)
+	namePointer, err := syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return nil, err
+	}
+
+	h, err := windows.OpenService(m.Handle, namePointer, windows.SERVICE_ALL_ACCESS)
 	if err != nil {
 		return nil, err
 	}

windows/svc/mgr/recovery.go

@@ -99,8 +99,13 @@ func (s *Service) ResetPeriod() (uint32, error) {
 // SetRebootMessage sets service s reboot message.
 // If msg is "", the reboot message is deleted and no message is broadcast.
 func (s *Service) SetRebootMessage(msg string) error {
+	msgPointer, err := syscall.UTF16PtrFromString(msg)
+	if err != nil {
+		return err
+	}
+
 	rActions := windows.SERVICE_FAILURE_ACTIONS{
-		RebootMsg: syscall.StringToUTF16Ptr(msg),
+		RebootMsg: msgPointer,
 	}
 	return windows.ChangeServiceConfig2(s.Handle, windows.SERVICE_CONFIG_FAILURE_ACTIONS, (*byte)(unsafe.Pointer(&rActions)))
 }
@@ -118,8 +123,13 @@ func (s *Service) RebootMessage() (string, error) {
 // SetRecoveryCommand sets the command line of the process to execute in response to the RunCommand service controller action.
 // If cmd is "", the command is deleted and no program is run when the service fails.
 func (s *Service) SetRecoveryCommand(cmd string) error {
+	cmdPointer, err := syscall.UTF16PtrFromString(cmd)
+	if err != nil {
+		return err
+	}
+
 	rActions := windows.SERVICE_FAILURE_ACTIONS{
-		Command: syscall.StringToUTF16Ptr(cmd),
+		Command: cmdPointer,
 	}
 	return windows.ChangeServiceConfig2(s.Handle, windows.SERVICE_CONFIG_FAILURE_ACTIONS, (*byte)(unsafe.Pointer(&rActions)))
 }

windows/svc/mgr/service.go

@@ -37,7 +37,11 @@ func (s *Service) Start(args ...string) error {
 	if len(args) > 0 {
 		vs := make([]*uint16, len(args))
 		for i := range vs {
-			vs[i] = syscall.StringToUTF16Ptr(args[i])
+			argPointer, err := syscall.UTF16PtrFromString(args[i])
+			if err != nil {
+				return err
+			}
+			vs[i] = argPointer
 		}
 		p = &vs[0]
 	}