From 4bd6f2da89516e4271761b58817d990b4b0038d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Fri, 14 Oct 2022 17:19:36 +0800
Subject: [PATCH] TerminalShell: add lock ( Windows )

---
 .../terminalshell/terminalshell_windows.cpp    | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/detection/terminalshell/terminalshell_windows.cpp b/src/detection/terminalshell/terminalshell_windows.cpp
index ed19f9099..0f72942cd 100644
--- a/src/detection/terminalshell/terminalshell_windows.cpp
+++ b/src/detection/terminalshell/terminalshell_windows.cpp
@@ -1,6 +1,7 @@
 extern "C" {
 #include "terminalshell.h"
 #include "common/processing.h"
+#include "common/thread.h"
 }
 #include "util/windows/wmi.hpp"
 
@@ -108,10 +109,17 @@ static uint32_t getTerminalInfo(FFTerminalShellResult* result, uint32_t pid)
 
 const FFTerminalShellResult* ffDetectTerminalShell(const FFinstance* instance)
 {
+    FF_UNUSED(instance);
+
+    static FFThreadMutex mutex = FF_THREAD_MUTEX_INITIALIZER;
     static FFTerminalShellResult result;
     static bool init = false;
+    ffThreadMutexLock(&mutex);
     if(init)
+    {
+        ffThreadMutexUnlock(&mutex);
         return &result;
+    }
     init = true;
 
     ffStrbufInit(&result.shellProcessName);
@@ -131,17 +139,17 @@ const FFTerminalShellResult* ffDetectTerminalShell(const FFinstance* instance)
 
     uint32_t ppid = GetCurrentProcessId();
     if(!getProcessInfo(ppid, &ppid, nullptr, nullptr))
-        return &result;
+        goto exit;
 
     ppid = getShellInfo(&result, ppid);
     if(ppid == 0)
-        return &result;
+        goto exit;
 
     // TODO: handle nested shells
 
-    ppid = getTerminalInfo(&result, ppid);
-    if(ppid == 0)
-        return &result;
+    getTerminalInfo(&result, ppid);
 
+exit:
+    ffThreadMutexUnlock(&mutex);
     return &result;
 }