November 2007 - Wine-commits

Juan Lang : shell32: Remove a bad comment.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: 52da1b169a71446175d71741ab4fac6f1c66bd6e URL: http://source.winehq.org/git/wine.git/?a=commit;h=52da1b169a71446175d71741a… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 14:11:49 2007 -0800 shell32: Remove a bad comment. --- dlls/shell32/shlexec.c | 6 +----- 1 files changed, 1 insertions(+), 5 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index c95d599..a6a7138 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -632,11 +632,7 @@ UINT SHELL_FindExecutable(LPCWSTR lpPath, LPCWSTR lpFile, LPCWSTR lpOperation, * attached */ TRACE("found %s\n", debugstr_w(lpResult)); return 33; - - /* Greater than 32 to indicate success FIXME According to the - * docs, I should be returning a handle for the - * executable. Does this mean I'm supposed to open the - * executable file or something? More RTFM, I guess... */ + /* Greater than 32 to indicate success */ } tok = p; }

1 0

Juan Lang : shell32: Use a helper function for executing a class.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: 865a40651d161e8224282d8c11ee52ba2c59dddf URL: http://source.winehq.org/git/wine.git/?a=commit;h=865a40651d161e8224282d8c1… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 12:36:18 2007 -0800 shell32: Use a helper function for executing a class. --- dlls/shell32/shlexec.c | 58 +++++++++++++++++++++++++++-------------------- 1 files changed, 33 insertions(+), 25 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index d1df3be..6bfa257 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -1289,6 +1289,37 @@ static LONG ShellExecute_FromContextMenu( LPSHELLEXECUTEINFOW sei ) return r; } +static UINT_PTR SHELL_execute_class( LPCWSTR wszApplicationName, LPSHELLEXECUTEINFOW psei, LPSHELLEXECUTEINFOW psei_out, SHELL_ExecuteW32 execfunc ) +{ + static const WCHAR wSpace[] = {' ',0}; + WCHAR execCmd[1024], wcmd[1024]; + /* launch a document by fileclass like 'WordPad.Document.1' */ + /* the Commandline contains 'c:\Path\wordpad.exe "%1"' */ + /* FIXME: wcmd should not be of a fixed size. Fixed to 1024, MAX_PATH is way too short! */ + ULONG cmask=(psei->fMask & SEE_MASK_CLASSALL); + DWORD resultLen; + BOOL done; + + HCR_GetExecuteCommandW((cmask == SEE_MASK_CLASSKEY) ? psei->hkeyClass : NULL, + (cmask == SEE_MASK_CLASSNAME) ? psei->lpClass: NULL, + psei->lpVerb, + execCmd, sizeof(execCmd)); + + /* FIXME: get the extension of lpFile, check if it fits to the lpClass */ + TRACE("SEE_MASK_CLASSNAME->%s, doc->%s\n", debugstr_w(execCmd), debugstr_w(wszApplicationName)); + + wcmd[0] = '\0'; + done = SHELL_ArgifyW(wcmd, sizeof(wcmd)/sizeof(WCHAR), execCmd, wszApplicationName, psei->lpIDList, NULL, &resultLen); + if (!done && wszApplicationName[0]) + { + strcatW(wcmd, wSpace); + strcatW(wcmd, wszApplicationName); + } + if (resultLen > sizeof(wcmd)/sizeof(WCHAR)) + ERR("Argify buffer not large enough... truncating\n"); + return execfunc(wcmd, NULL, FALSE, psei, psei_out); +} + /************************************************************************* * SHELL_execute [Internal] */ @@ -1318,7 +1349,6 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) UINT_PTR retval = SE_ERR_NOASSOC; WCHAR wcmd[1024]; WCHAR buffer[MAX_PATH]; - BOOL done; BOOL appKnownSingular = FALSE; /* make a local copy of the LPSHELLEXECUTEINFO structure and work with this from now on */ @@ -1422,30 +1452,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) if (sei_tmp.fMask & SEE_MASK_CLASSALL) { - /* launch a document by fileclass like 'WordPad.Document.1' */ - /* the Commandline contains 'c:\Path\wordpad.exe "%1"' */ - /* FIXME: szCommandline should not be of a fixed size. Fixed to 1024, MAX_PATH is way too short! */ - ULONG cmask=(sei_tmp.fMask & SEE_MASK_CLASSALL); - DWORD resultLen; - HCR_GetExecuteCommandW((cmask == SEE_MASK_CLASSKEY) ? sei_tmp.hkeyClass : NULL, - (cmask == SEE_MASK_CLASSNAME) ? sei_tmp.lpClass: NULL, - sei_tmp.lpVerb, - wszParameters, parametersLen); - - /* FIXME: get the extension of lpFile, check if it fits to the lpClass */ - TRACE("SEE_MASK_CLASSNAME->%s, doc->%s\n", debugstr_w(wszParameters), debugstr_w(wszApplicationName)); - - wcmd[0] = '\0'; - done = SHELL_ArgifyW(wcmd, sizeof(wcmd)/sizeof(WCHAR), wszParameters, wszApplicationName, sei_tmp.lpIDList, NULL, &resultLen); - if (!done && wszApplicationName[0]) - { - strcatW(wcmd, wSpace); - strcatW(wcmd, wszApplicationName); - } - if (resultLen > sizeof(wcmd)/sizeof(WCHAR)) - ERR("Argify buffer not large enough... truncating\n"); - retval = execfunc(wcmd, NULL, FALSE, &sei_tmp, sei); - + retval = SHELL_execute_class( wszApplicationName, &sei_tmp, sei, + execfunc ); HeapFree(GetProcessHeap(), 0, wszApplicationName); if (wszParameters != parametersBuffer) HeapFree(GetProcessHeap(), 0, wszParameters);

1 0

Juan Lang : shell32: Use helper function to translate ID list.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: fd12e340cf2652ed9154ba160499968408d20351 URL: http://source.winehq.org/git/wine.git/?a=commit;h=fd12e340cf2652ed9154ba160… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 12:37:00 2007 -0800 shell32: Use helper function to translate ID list. --- dlls/shell32/shlexec.c | 83 +++++++++++++++++++++++++++++------------------- 1 files changed, 50 insertions(+), 33 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index 6bfa257..14bc50a 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -1320,6 +1320,52 @@ static UINT_PTR SHELL_execute_class( LPCWSTR wszApplicationName, LPSHELLEXECUTEI return execfunc(wcmd, NULL, FALSE, psei, psei_out); } +static BOOL SHELL_translate_idlist( LPSHELLEXECUTEINFOW sei, LPWSTR wszParameters, DWORD parametersLen, LPWSTR wszApplicationName, DWORD dwApplicationNameLen ) +{ + static const WCHAR wExplorer[] = {'e','x','p','l','o','r','e','r','.','e','x','e',0}; + WCHAR buffer[MAX_PATH]; + BOOL appKnownSingular = FALSE; + + /* last chance to translate IDList: now also allow CLSID paths */ + if (SUCCEEDED(SHELL_GetPathFromIDListForExecuteW(sei->lpIDList, buffer, sizeof(buffer)))) { + if (buffer[0]==':' && buffer[1]==':') { + /* open shell folder for the specified class GUID */ + if (lstrlenW(buffer) + 1 > parametersLen) + ERR("parameters len exceeds buffer size (%i > %i), truncating\n", + lstrlenW(buffer) + 1, parametersLen); + lstrcpynW(wszParameters, buffer, parametersLen); + if (lstrlenW(wExplorer) > dwApplicationNameLen) + ERR("application len exceeds buffer size (%i > %i), truncating\n", + lstrlenW(wExplorer) + 1, dwApplicationNameLen); + lstrcpynW(wszApplicationName, wExplorer, dwApplicationNameLen); + appKnownSingular = TRUE; + + sei->fMask &= ~SEE_MASK_INVOKEIDLIST; + } else { + WCHAR target[MAX_PATH]; + DWORD attribs; + DWORD resultLen; + /* Check if we're executing a directory and if so use the + handler for the Folder class */ + strcpyW(target, buffer); + attribs = GetFileAttributesW(buffer); + if (attribs != INVALID_FILE_ATTRIBUTES && + (attribs & FILE_ATTRIBUTE_DIRECTORY) && + HCR_GetExecuteCommandW(0, wszFolder, + sei->lpVerb, + buffer, sizeof(buffer))) { + SHELL_ArgifyW(wszApplicationName, dwApplicationNameLen, + buffer, target, sei->lpIDList, NULL, &resultLen); + if (resultLen > dwApplicationNameLen) + ERR("Argify buffer not large enough... truncating\n"); + appKnownSingular = FALSE; + } + sei->fMask &= ~SEE_MASK_INVOKEIDLIST; + } + } + return appKnownSingular; +} + /************************************************************************* * SHELL_execute [Internal] */ @@ -1330,7 +1376,6 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) static const WCHAR wWww[] = {'w','w','w',0}; static const WCHAR wFile[] = {'f','i','l','e',0}; static const WCHAR wHttp[] = {'h','t','t','p',':','/','/',0}; - static const WCHAR wExplorer[] = {'e','x','p','l','o','r','e','r','.','e','x','e',0}; static const DWORD unsupportedFlags = SEE_MASK_INVOKEIDLIST | SEE_MASK_ICON | SEE_MASK_HOTKEY | SEE_MASK_CONNECTNETDRV | SEE_MASK_FLAG_DDEWAIT | SEE_MASK_FLAG_NO_UI | @@ -1348,7 +1393,6 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) LPCWSTR lpFile; UINT_PTR retval = SE_ERR_NOASSOC; WCHAR wcmd[1024]; - WCHAR buffer[MAX_PATH]; BOOL appKnownSingular = FALSE; /* make a local copy of the LPSHELLEXECUTEINFO structure and work with this from now on */ @@ -1463,37 +1507,10 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) /* Has the IDList not yet been translated? */ if (sei_tmp.fMask & SEE_MASK_IDLIST) { - /* last chance to translate IDList: now also allow CLSID paths */ - if (SUCCEEDED(SHELL_GetPathFromIDListForExecuteW(sei_tmp.lpIDList, buffer, sizeof(buffer)))) { - if (buffer[0]==':' && buffer[1]==':') { - /* open shell folder for the specified class GUID */ - strcpyW(wszParameters, buffer); - strcpyW(wszApplicationName, wExplorer); - appKnownSingular = TRUE; - - sei_tmp.fMask &= ~SEE_MASK_INVOKEIDLIST; - } else { - WCHAR target[MAX_PATH]; - DWORD attribs; - DWORD resultLen; - /* Check if we're executing a directory and if so use the - handler for the Folder class */ - strcpyW(target, buffer); - attribs = GetFileAttributesW(buffer); - if (attribs != INVALID_FILE_ATTRIBUTES && - (attribs & FILE_ATTRIBUTE_DIRECTORY) && - HCR_GetExecuteCommandW(0, wszFolder, - sei_tmp.lpVerb, - buffer, sizeof(buffer))) { - SHELL_ArgifyW(wszApplicationName, dwApplicationNameLen, - buffer, target, sei_tmp.lpIDList, NULL, &resultLen); - if (resultLen > dwApplicationNameLen) - ERR("Argify buffer not large enough... truncating\n"); - appKnownSingular = FALSE; - } - sei_tmp.fMask &= ~SEE_MASK_INVOKEIDLIST; - } - } + appKnownSingular = SHELL_translate_idlist( &sei_tmp, wszParameters, + parametersLen, + wszApplicationName, + dwApplicationNameLen ); } /* expand environment strings */

1 0

Juan Lang : shell32: Dynamically allocate directory buffer.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: 645802d748f774d108d491e25e02fb35edb58886 URL: http://source.winehq.org/git/wine.git/?a=commit;h=645802d748f774d108d491e25… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 12:37:27 2007 -0800 shell32: Dynamically allocate directory buffer. --- dlls/shell32/shlexec.c | 32 ++++++++++++++++++++++++++------ 1 files changed, 26 insertions(+), 6 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index 14bc50a..b68c9a2 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -1381,10 +1381,11 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) SEE_MASK_CONNECTNETDRV | SEE_MASK_FLAG_DDEWAIT | SEE_MASK_FLAG_NO_UI | SEE_MASK_UNICODE | SEE_MASK_ASYNCOK | SEE_MASK_HMONITOR; - WCHAR parametersBuffer[1024]; - WCHAR *wszApplicationName, *wszParameters, wszDir[MAX_PATH]; + WCHAR parametersBuffer[1024], dirBuffer[MAX_PATH]; + WCHAR *wszApplicationName, *wszParameters, *wszDir; DWORD dwApplicationNameLen = MAX_PATH+2; DWORD parametersLen = sizeof(parametersBuffer) / sizeof(WCHAR); + DWORD dirLen = sizeof(dirBuffer) / sizeof(WCHAR); DWORD len; SHELLEXECUTEINFOW sei_tmp; /* modifiable copy of SHELLEXECUTEINFO struct */ WCHAR wfileName[MAX_PATH]; @@ -1444,8 +1445,17 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) else *wszParameters = '\0'; + wszDir = dirBuffer; if (sei_tmp.lpDirectory) + { + len = lstrlenW(sei_tmp.lpDirectory) + 1; + if (len > dirLen) + { + wszDir = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR)); + dirLen = len; + } strcpyW(wszDir, sei_tmp.lpDirectory); + } else *wszDir = '\0'; @@ -1476,6 +1486,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) HeapFree(GetProcessHeap(), 0, wszApplicationName); if (wszParameters != parametersBuffer) HeapFree(GetProcessHeap(), 0, wszParameters); + if (wszDir != dirBuffer) + HeapFree(GetProcessHeap(), 0, wszDir); return TRUE; } } @@ -1491,6 +1503,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) HeapFree(GetProcessHeap(), 0, wszApplicationName); if (wszParameters != parametersBuffer) HeapFree(GetProcessHeap(), 0, wszParameters); + if (wszDir != dirBuffer) + HeapFree(GetProcessHeap(), 0, wszDir); return TRUE; } @@ -1501,6 +1515,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) HeapFree(GetProcessHeap(), 0, wszApplicationName); if (wszParameters != parametersBuffer) HeapFree(GetProcessHeap(), 0, wszParameters); + if (wszDir != dirBuffer) + HeapFree(GetProcessHeap(), 0, wszDir); return retval > 32; } @@ -1555,10 +1571,10 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) len++; buf = HeapAlloc(GetProcessHeap(),0,len*sizeof(WCHAR)); ExpandEnvironmentStringsW(sei_tmp.lpDirectory, buf, len); - if (len > 1024) - ERR("Directory exceeds buffer size (%i > 1024)\n",len); - lstrcpynW(wszDir, buf, min(1024,len)); - HeapFree(GetProcessHeap(),0,buf); + if (wszDir != dirBuffer) + HeapFree(GetProcessHeap(), 0, wszDir); + wszDir = buf; + sei_tmp.lpDirectory = wszDir; } } @@ -1640,6 +1656,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) HeapFree(GetProcessHeap(), 0, wszApplicationName); if (wszParameters != parametersBuffer) HeapFree(GetProcessHeap(), 0, wszParameters); + if (wszDir != dirBuffer) + HeapFree(GetProcessHeap(), 0, wszDir); return TRUE; } @@ -1711,6 +1729,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) HeapFree(GetProcessHeap(), 0, wszApplicationName); if (wszParameters != parametersBuffer) HeapFree(GetProcessHeap(), 0, wszParameters); + if (wszDir != dirBuffer) + HeapFree(GetProcessHeap(), 0, wszDir); sei->hInstApp = (HINSTANCE)(retval > 32 ? 33 : retval); return retval > 32;

1 0

Juan Lang : shell32: Use a helper function for executing a found executable .
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: e3dbbd14354b9b145089a0595493208fdf9ce575 URL: http://source.winehq.org/git/wine.git/?a=commit;h=e3dbbd14354b9b145089a0595… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 12:39:15 2007 -0800 shell32: Use a helper function for executing a found executable. --- dlls/shell32/shlexec.c | 44 +++++++++++++++++++++++++++----------------- 1 files changed, 27 insertions(+), 17 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index b68c9a2..5b1a625 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -1366,12 +1366,35 @@ static BOOL SHELL_translate_idlist( LPSHELLEXECUTEINFOW sei, LPWSTR wszParameter return appKnownSingular; } +static UINT_PTR SHELL_quote_and_execute( LPCWSTR wcmd, LPCWSTR wszParameters, LPWSTR lpstrProtocol, LPCWSTR wszApplicationName, LPWSTR env, LPSHELLEXECUTEINFOW psei, LPSHELLEXECUTEINFOW psei_out, SHELL_ExecuteW32 execfunc ) +{ + static const WCHAR wQuote[] = {'"',0}; + static const WCHAR wSpace[] = {' ',0}; + UINT_PTR retval; + WCHAR wszQuotedCmd[MAX_PATH+2]; + /* Must quote to handle case where cmd contains spaces, + * else security hole if malicious user creates executable file "C:\\Program" + */ + strcpyW(wszQuotedCmd, wQuote); + strcatW(wszQuotedCmd, wcmd); + strcatW(wszQuotedCmd, wQuote); + if (wszParameters[0]) { + strcatW(wszQuotedCmd, wSpace); + strcatW(wszQuotedCmd, wszParameters); + } + TRACE("%s/%s => %s/%s\n", debugstr_w(wszApplicationName), debugstr_w(psei->lpVerb), debugstr_w(wszQuotedCmd), debugstr_w(lpstrProtocol)); + if (*lpstrProtocol) + retval = execute_from_key(lpstrProtocol, wszApplicationName, env, psei->lpParameters, wcmd, execfunc, psei, psei_out); + else + retval = execfunc(wszQuotedCmd, env, FALSE, psei, psei_out); + return retval; +} + /************************************************************************* * SHELL_execute [Internal] */ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) { - static const WCHAR wQuote[] = {'"',0}; static const WCHAR wSpace[] = {' ',0}; static const WCHAR wWww[] = {'w','w','w',0}; static const WCHAR wFile[] = {'f','i','l','e',0}; @@ -1666,22 +1689,9 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) retval = SHELL_FindExecutable(sei_tmp.lpDirectory, lpFile, sei_tmp.lpVerb, wcmd, 1024, lpstrProtocol, &env, sei_tmp.lpIDList, sei_tmp.lpParameters); if (retval > 32) /* Found */ { - WCHAR wszQuotedCmd[MAX_PATH+2]; - /* Must quote to handle case where cmd contains spaces, - * else security hole if malicious user creates executable file "C:\\Program" - */ - strcpyW(wszQuotedCmd, wQuote); - strcatW(wszQuotedCmd, wcmd); - strcatW(wszQuotedCmd, wQuote); - if (wszParameters[0]) { - strcatW(wszQuotedCmd, wSpace); - strcatW(wszQuotedCmd, wszParameters); - } - TRACE("%s/%s => %s/%s\n", debugstr_w(wszApplicationName), debugstr_w(sei_tmp.lpVerb), debugstr_w(wszQuotedCmd), debugstr_w(lpstrProtocol)); - if (*lpstrProtocol) - retval = execute_from_key(lpstrProtocol, wszApplicationName, env, sei_tmp.lpParameters, wcmd, execfunc, &sei_tmp, sei); - else - retval = execfunc(wszQuotedCmd, env, FALSE, &sei_tmp, sei); + retval = SHELL_quote_and_execute( wcmd, wszParameters, lpstrProtocol, + wszApplicationName, env, &sei_tmp, + sei, execfunc ); HeapFree( GetProcessHeap(), 0, env ); } else if (PathIsURLW(lpFile)) /* File not found, check for URL */

1 0

Juan Lang : shell32: Dynamically allocate buffer for quoted command.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: b829f034f57ef757c5ddedb62d516eae49f05ac7 URL: http://source.winehq.org/git/wine.git/?a=commit;h=b829f034f57ef757c5ddedb62… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 12:40:25 2007 -0800 shell32: Dynamically allocate buffer for quoted command. --- dlls/shell32/shlexec.c | 13 ++++++++++++- 1 files changed, 12 insertions(+), 1 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index 5b1a625..2036a09 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -1371,7 +1371,17 @@ static UINT_PTR SHELL_quote_and_execute( LPCWSTR wcmd, LPCWSTR wszParameters, LP static const WCHAR wQuote[] = {'"',0}; static const WCHAR wSpace[] = {' ',0}; UINT_PTR retval; - WCHAR wszQuotedCmd[MAX_PATH+2]; + DWORD len; + WCHAR *wszQuotedCmd; + + /* Length of quotes plus length of command plus NULL terminator */ + len = 2 + lstrlenW(wcmd) + 1; + if (wszParameters[0]) + { + /* Length of space plus length of parameters */ + len += 1 + lstrlenW(wszParameters); + } + wszQuotedCmd = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR)); /* Must quote to handle case where cmd contains spaces, * else security hole if malicious user creates executable file "C:\\Program" */ @@ -1387,6 +1397,7 @@ static UINT_PTR SHELL_quote_and_execute( LPCWSTR wcmd, LPCWSTR wszParameters, LP retval = execute_from_key(lpstrProtocol, wszApplicationName, env, psei->lpParameters, wcmd, execfunc, psei, psei_out); else retval = execfunc(wszQuotedCmd, env, FALSE, psei, psei_out); + HeapFree(GetProcessHeap(), 0, wszQuotedCmd); return retval; }

1 0

Juan Lang : shell32: Don't overwrite the caller' s buffer when doing a dde connection.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: 987ba237aa24ab6163a7e9d12e99643e3dbb5f6a URL: http://source.winehq.org/git/wine.git/?a=commit;h=987ba237aa24ab6163a7e9d12… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 12:40:56 2007 -0800 shell32: Don't overwrite the caller's buffer when doing a dde connection. --- dlls/shell32/shlexec.c | 12 +++++++----- 1 files changed, 7 insertions(+), 5 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index 2036a09..b5000e2 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -749,14 +749,15 @@ static HDDEDATA CALLBACK dde_cb(UINT uType, UINT uFmt, HCONV hConv, * launching an application and trying (#2) to connect to it * */ -static unsigned dde_connect(WCHAR* key, const WCHAR* start, WCHAR* ddeexec, +static unsigned dde_connect(const WCHAR* key, const WCHAR* start, WCHAR* ddeexec, const WCHAR* lpFile, WCHAR *env, LPCWSTR szCommandline, LPITEMIDLIST pidl, SHELL_ExecuteW32 execfunc, const SHELLEXECUTEINFOW *psei, LPSHELLEXECUTEINFOW psei_out) { static const WCHAR wApplication[] = {'\\','a','p','p','l','i','c','a','t','i','o','n',0}; static const WCHAR wTopic[] = {'\\','t','o','p','i','c',0}; - WCHAR * endkey = key + strlenW(key); + WCHAR regkey[256]; + WCHAR * endkey = regkey + strlenW(key); WCHAR app[256], topic[256], ifexec[256], res[256]; LONG applen, topiclen, ifexeclen; WCHAR * exec; @@ -769,9 +770,10 @@ static unsigned dde_connect(WCHAR* key, const WCHAR* start, WCHAR* ddeexec, unsigned ret = SE_ERR_NOASSOC; BOOL unicode = !(GetVersion() & 0x80000000); + strcpyW(regkey, key); strcpyW(endkey, wApplication); applen = sizeof(app); - if (RegQueryValueW(HKEY_CLASSES_ROOT, key, app, &applen) != ERROR_SUCCESS) + if (RegQueryValueW(HKEY_CLASSES_ROOT, regkey, app, &applen) != ERROR_SUCCESS) { WCHAR command[1024], fullpath[MAX_PATH]; static const WCHAR wSo[] = { '.','s','o',0 }; @@ -822,7 +824,7 @@ static unsigned dde_connect(WCHAR* key, const WCHAR* start, WCHAR* ddeexec, strcpyW(endkey, wTopic); topiclen = sizeof(topic); - if (RegQueryValueW(HKEY_CLASSES_ROOT, key, topic, &topiclen) != ERROR_SUCCESS) + if (RegQueryValueW(HKEY_CLASSES_ROOT, regkey, topic, &topiclen) != ERROR_SUCCESS) { static const WCHAR wSystem[] = {'S','y','s','t','e','m',0}; strcpyW(topic, wSystem); @@ -864,7 +866,7 @@ static unsigned dde_connect(WCHAR* key, const WCHAR* start, WCHAR* ddeexec, } strcpyW(endkey, wIfexec); ifexeclen = sizeof(ifexec); - if (RegQueryValueW(HKEY_CLASSES_ROOT, key, ifexec, &ifexeclen) == ERROR_SUCCESS) + if (RegQueryValueW(HKEY_CLASSES_ROOT, regkey, ifexec, &ifexeclen) == ERROR_SUCCESS) { exec = ifexec; }

1 0

Juan Lang : iphlpapi: Correct copy/paste error in GetTcpTable.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: 03b63500f03d9639e48b2d74f6ad088957ae9ef0 URL: http://source.winehq.org/git/wine.git/?a=commit;h=03b63500f03d9639e48b2d74f… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 10:25:11 2007 -0800 iphlpapi: Correct copy/paste error in GetTcpTable. --- dlls/iphlpapi/iphlpapi_main.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/iphlpapi/iphlpapi_main.c b/dlls/iphlpapi/iphlpapi_main.c index 0de8858..f9ebffe 100644 --- a/dlls/iphlpapi/iphlpapi_main.c +++ b/dlls/iphlpapi/iphlpapi_main.c @@ -1600,8 +1600,8 @@ DWORD WINAPI GetTcpTable(PMIB_TCPTABLE pTcpTable, PDWORD pdwSize, BOOL bOrder) ret = getTcpTable(&pTcpTable, numEntries, 0, 0); if (!ret) { size = sizeof(MIB_TCPTABLE); - if (numEntries > 1) - size += (numEntries - 1) * sizeof(MIB_TCPROW); + if (pTcpTable->dwNumEntries > 1) + size += (pTcpTable->dwNumEntries - 1) * sizeof(MIB_TCPROW); *pdwSize = size; if (bOrder)

1 0

Juan Lang : iphlpapi: Correct confusing indentation in GetTcpTable.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: 6ec1eaf32afac586594f4f96e5d4a23281ad7832 URL: http://source.winehq.org/git/wine.git/?a=commit;h=6ec1eaf32afac586594f4f96e… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 10:25:40 2007 -0800 iphlpapi: Correct confusing indentation in GetTcpTable. --- dlls/iphlpapi/iphlpapi_main.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dlls/iphlpapi/iphlpapi_main.c b/dlls/iphlpapi/iphlpapi_main.c index f9ebffe..14a6fa4 100644 --- a/dlls/iphlpapi/iphlpapi_main.c +++ b/dlls/iphlpapi/iphlpapi_main.c @@ -1604,10 +1604,10 @@ DWORD WINAPI GetTcpTable(PMIB_TCPTABLE pTcpTable, PDWORD pdwSize, BOOL bOrder) size += (pTcpTable->dwNumEntries - 1) * sizeof(MIB_TCPROW); *pdwSize = size; - if (bOrder) - qsort(pTcpTable->table, pTcpTable->dwNumEntries, - sizeof(MIB_TCPROW), TcpTableSorter); - ret = NO_ERROR; + if (bOrder) + qsort(pTcpTable->table, pTcpTable->dwNumEntries, + sizeof(MIB_TCPROW), TcpTableSorter); + ret = NO_ERROR; } } }

1 0

Juan Lang : shell32: Dynamically allocate buffer for command parameters.
by Alexandre Julliard 19 Nov '07

19 Nov '07

Module: wine Branch: master Commit: f53abfcee186facd82336297af8dbeebccab496d URL: http://source.winehq.org/git/wine.git/?a=commit;h=f53abfcee186facd82336297a… Author: Juan Lang <juan.lang(a)gmail.com> Date: Fri Nov 16 12:33:58 2007 -0800 shell32: Dynamically allocate buffer for command parameters. --- dlls/shell32/shlexec.c | 34 ++++++++++++++++++++++++++++------ 1 files changed, 28 insertions(+), 6 deletions(-) diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c index 9800043..d1df3be 100644 --- a/dlls/shell32/shlexec.c +++ b/dlls/shell32/shlexec.c @@ -1305,8 +1305,10 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) SEE_MASK_CONNECTNETDRV | SEE_MASK_FLAG_DDEWAIT | SEE_MASK_FLAG_NO_UI | SEE_MASK_UNICODE | SEE_MASK_ASYNCOK | SEE_MASK_HMONITOR; - WCHAR *wszApplicationName, wszParameters[1024], wszDir[MAX_PATH]; + WCHAR parametersBuffer[1024]; + WCHAR *wszApplicationName, *wszParameters, wszDir[MAX_PATH]; DWORD dwApplicationNameLen = MAX_PATH+2; + DWORD parametersLen = sizeof(parametersBuffer) / sizeof(WCHAR); DWORD len; SHELLEXECUTEINFOW sei_tmp; /* modifiable copy of SHELLEXECUTEINFO struct */ WCHAR wfileName[MAX_PATH]; @@ -1354,8 +1356,17 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) memcpy(wszApplicationName, sei_tmp.lpFile, l*sizeof(WCHAR)); } + wszParameters = parametersBuffer; if (sei_tmp.lpParameters) + { + len = lstrlenW(sei_tmp.lpParameters) + 1; + if (len > parametersLen) + { + wszParameters = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR)); + parametersLen = len; + } strcpyW(wszParameters, sei_tmp.lpParameters); + } else *wszParameters = '\0'; @@ -1389,6 +1400,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) if (hr == S_OK) { HeapFree(GetProcessHeap(), 0, wszApplicationName); + if (wszParameters != parametersBuffer) + HeapFree(GetProcessHeap(), 0, wszParameters); return TRUE; } } @@ -1402,6 +1415,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) { sei->hInstApp = (HINSTANCE) 33; HeapFree(GetProcessHeap(), 0, wszApplicationName); + if (wszParameters != parametersBuffer) + HeapFree(GetProcessHeap(), 0, wszParameters); return TRUE; } @@ -1415,7 +1430,7 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) HCR_GetExecuteCommandW((cmask == SEE_MASK_CLASSKEY) ? sei_tmp.hkeyClass : NULL, (cmask == SEE_MASK_CLASSNAME) ? sei_tmp.lpClass: NULL, sei_tmp.lpVerb, - wszParameters, sizeof(wszParameters)/sizeof(WCHAR)); + wszParameters, parametersLen); /* FIXME: get the extension of lpFile, check if it fits to the lpClass */ TRACE("SEE_MASK_CLASSNAME->%s, doc->%s\n", debugstr_w(wszParameters), debugstr_w(wszApplicationName)); @@ -1432,6 +1447,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) retval = execfunc(wcmd, NULL, FALSE, &sei_tmp, sei); HeapFree(GetProcessHeap(), 0, wszApplicationName); + if (wszParameters != parametersBuffer) + HeapFree(GetProcessHeap(), 0, wszParameters); return retval > 32; } @@ -1496,10 +1513,11 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) len++; buf = HeapAlloc(GetProcessHeap(),0,len*sizeof(WCHAR)); ExpandEnvironmentStringsW(sei_tmp.lpParameters, buf, len); - if (len > 1024) - ERR("Parameters exceeds buffer size (%i > 1024)\n",len); - lstrcpynW(wszParameters, buf, min(1024,len)); - HeapFree(GetProcessHeap(),0,buf); + if (wszParameters != parametersBuffer) + HeapFree(GetProcessHeap(), 0, wszParameters); + wszParameters = buf; + parametersLen = len; + sei_tmp.lpParameters = wszParameters; } } @@ -1595,6 +1613,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) retval = execfunc(wcmd, NULL, FALSE, &sei_tmp, sei); if (retval > 32) { HeapFree(GetProcessHeap(), 0, wszApplicationName); + if (wszParameters != parametersBuffer) + HeapFree(GetProcessHeap(), 0, wszParameters); return TRUE; } @@ -1664,6 +1684,8 @@ BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc ) TRACE("retval %lu\n", retval); HeapFree(GetProcessHeap(), 0, wszApplicationName); + if (wszParameters != parametersBuffer) + HeapFree(GetProcessHeap(), 0, wszParameters); sei->hInstApp = (HINSTANCE)(retval > 32 ? 33 : retval); return retval > 32;

1 0