[PATCH 0/1] MR7872: shell32: Avoid writing past end of xlpFile or lpResult in SHELL_FindExecutable().

[Paul Gofman (＠gofman)]

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7872

[PATCH 1/1] shell32: Avoid writing past end of xlpFile or lpResult in SHELL_FindExecutable().

[Paul Gofman]

From: Paul Gofman <pgofman(a)codeweavers.com>

---
 dlls/shell32/shlexec.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c
index 956b844b572..08d350d631a 100644
--- a/dlls/shell32/shlexec.c
+++ b/dlls/shell32/shlexec.c
@@ -643,7 +643,7 @@ static UINT SHELL_FindExecutable(LPCWSTR lpPath, LPCWSTR lpFile, LPCWSTR lpVerb,
         }
         if (!found)
         {
-            lstrcpyW(xlpFile, lpFile);
+            wcsncpy_s(xlpFile, ARRAY_SIZE(xlpFile), lpFile, _TRUNCATE);
             if (PathFileExistsDefExtW(xlpFile, 0xbf) || PathFileExistsW(xlpFile))
             {
                 GetFullPathNameW(xlpFile, ARRAY_SIZE(xlpFile), xlpFile, NULL);
@@ -653,7 +653,7 @@ static UINT SHELL_FindExecutable(LPCWSTR lpPath, LPCWSTR lpFile, LPCWSTR lpVerb,
         if (found)
         {
             lpFile = xlpFile;
-            lstrcpyW(lpResult, xlpFile);
+            wcsncpy_s(lpResult, resultLen, xlpFile, _TRUNCATE);
         }
         else
             xlpFile[0] = '\0';
@@ -667,13 +667,13 @@ static UINT SHELL_FindExecutable(LPCWSTR lpPath, LPCWSTR lpFile, LPCWSTR lpVerb,
         }
         else
             search_paths[0] = curdir;
-        lstrcpyW(xlpFile, lpFile);
+        wcsncpy_s(xlpFile, ARRAY_SIZE(xlpFile), lpFile, _TRUNCATE);
         if (PathResolveW(xlpFile, search_paths, PRF_TRYPROGRAMEXTENSIONS | PRF_VERIFYEXISTS) ||
             PathFindOnPathW(xlpFile, search_paths))
         {
             TRACE("PathResolveAW returned non-zero\n");
             lpFile = xlpFile;
-            lstrcpyW(lpResult, xlpFile);
+            wcsncpy_s(lpResult, resultLen, xlpFile, _TRUNCATE);
             /* The file was found in lpPath or one of the directories in the system-wide search path */
         }
         else
@@ -799,16 +799,16 @@ static UINT SHELL_FindExecutable(LPCWSTR lpPath, LPCWSTR lpFile, LPCWSTR lpVerb,
         {
             if (*command)
             {
-                lstrcpyW(lpResult, command);
+                wcsncpy_s(lpResult, resultLen, command, _TRUNCATE);
                 tok = wcschr(lpResult, '^'); /* should be ^.extension? */
                 if (tok != NULL)
                 {
                     tok[0] = '\0';
-                    lstrcatW(lpResult, xlpFile); /* what if no dir in xlpFile? */
+                    wcscat_s(lpResult, resultLen, xlpFile); /* what if no dir in xlpFile? */
                     tok = wcschr(command, '^'); /* see above */
                     if ((tok != NULL) && (lstrlenW(tok)>5))
                     {
-                        lstrcatW(lpResult, &tok[5]);
+                        wcscat_s(lpResult, resultLen, &tok[5]);
                     }
                 }
                 retval = 33; /* FIXME - see above */
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/7872

[Paul Gofman (＠gofman)]

This helps "The Eminence in Shadow: Master of Garden" to show an account linking page in browser by starting
```
rundll32.exe url.dll,FileProtocolHandler https://<very long url>
```

Everything works on that path except for shell32.SHELL_FindExecutable() on the way (which is supposed to fail, proper handler is found after it) crashes after writing past end of xlpFile buffer.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7872#note_101608

[Alexandre Julliard (＠julliard)]

Please check for errors instead of silently truncating.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7872#note_101878