[Bug 10345] New: ShellExecute with very long params crashes (affects Picasa )
http://bugs.winehq.org/show_bug.cgi?id=10345 Summary: ShellExecute with very long params crashes (affects Picasa) Product: Wine Version: 0.9.20. Platform: Other URL: http://dl.google.com/picasa/picasaweb-current-setup.exe OS/Version: other Status: NEW Keywords: download Severity: normal Priority: P2 Component: wine-shell32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com With current Windows picasa, some users reported a crash caused by overflow of a fixed-size buffer in SHELL_execute(). That buffer size is still fixed and small in current git (I think). To repeat: 1. Launch picasa, select a folder. 2. Login to Picasa 'Web Albums', click on 'Web Album' button in display tray. 3. 'Send n photos to a Picasa Web Album' dialog is opened. 4. Click on 'Upgrade storage...' button. It crashes on some machines. On those machines, the following err is seen: err:exec:SHELL_execute Parameters exceeds buffer size (1126 > 1024) SHELL_execute is 350 lines long (yargh!), which makes a proper fix a bit of a challenge, but bumping up the size of one of the buffers in that function does make the problem go away. On a machine that doesn't crash, the parameter being passed to winebrowser is 900 or so bytes long, which is still perilously close to the 1024 byte limit. For reference, here's what +relay shows for that call. 0009:Call shell32.ShellExecuteA(00000000,008c5f98 "open",00ca692c "c:\\windows\\system32\\winebrowser.exe",01e247e4 "\"https://www.google.com/accounts/TokenAuth?auth=xhF6GxYBAAA,.2VMY_71Prxa88heF-y3T_Vo4JJXx4zxc2nF46Xwo5AsXhMP2eC7ZzojJlWZfpZeEzKTwm1nOAQHxvdkDmNMcybcjlJZ121aFpisyAUaMfk1jS7MI7sPhWPC7y9siR3ekLQlkp8MxM0k8w2240-3wJVcld81dXwZqo0jVKQkSzN26Rindn8vDC7K7D8C-U2QNzuFnLFMqaZ1pL3Lkz9ZDWGTlBK8wNRud1Cpnlmde02CWcYE"...,00000000,00000005) ret=00703902 -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=10345 Juan Lang <juan_lang(a)yahoo.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |juan_lang(a)yahoo.com --- Comment #1 from Juan Lang <juan_lang(a)yahoo.com> 2007-11-16 14:56:11 --- I sent a series of patches to address this, beginning with this one: http://www.winehq.org/pipermail/wine-patches/2007-November/046839.html I wasn't able to reproduce the crash myself, but hopefully this works for you. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=10345 Juan Lang <juan_lang(a)yahoo.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Juan Lang <juan_lang(a)yahoo.com> 2007-11-19 09:37:06 --- I believe this is now fixed. There's still one code path that uses a static buffer, but it's not called by Picasa. Please reopen if it isn't fixed for you. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=10345 Dan Kegel <dank(a)kegel.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #3 from Dan Kegel <dank(a)kegel.com> 2008-01-28 05:41:39 --- Closing all RESOLVED FIXED bugs older than four weeks. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org