From eee640c93874317ab3ff62ca6afda962ac96d999 Mon Sep 17 00:00:00 2001 From: Jiajin Cui Date: Wed, 21 Jun 2023 17:53:52 +0800 Subject: [PATCH] shell32: Make sure wcmd has enough space to hold the string. If the length of wszApplicationName exceeds 1024, it will cause an error when writing to the subsequent stack space after exceeding the wcmd space, Wcmd needs to be modified to dynamic allocation. Signed-off-by: Jiajin Cui --- dlls/shell32/shlexec.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index da2b5fdc2b0..43e965ca7d5 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -1764,6 +1764,14 @@ static BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) TRACE("execute:%s,%s,%s\n", debugstr_w(wszApplicationName), debugstr_w(wszParameters), debugstr_w(wszDir)); lpFile = sei_tmp.lpFile; wcmd = wcmdBuffer; + len = lstrlenW(wszApplicationName) + 3; + if (sei_tmp.lpParameters[0]) + len += 1 + lstrlenW(wszParameters); + if (len > wcmdLen) + { + wcmd = heap_alloc(len * sizeof(WCHAR)); + wcmdLen = len; + } lstrcpyW(wcmd, wszApplicationName); if (sei_tmp.lpDirectory) {