http://bugs.winehq.org/show_bug.cgi?id=60383 Bug ID: 60383 Summary: cmd: stack buffer overflow in search_command with a quoted /c command line longer than MAX_PATH Product: Wine Version: unspecified Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: cmd Assignee: wine-bugs@list.winehq.org Reporter: dnlbtz@gmail.com Target Milestone: --- Distribution: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Build Identifier: Wine 11.18 (built from the release tarball, --enable-archs=i386,x86_64); the affected code is unchanged in master 9d17984f (2026-09-24) cmd.exe crashes with an access violation when it is started as cmd /c "<program> <arguments>" with the whole command line in one pair of quotes, longer than MAX_PATH and containing a backslash. That is the form Python's subprocess produces for shell=True on Windows, so any Python tool that shells out long MSBuild or compiler lines under Wine hits it; I found it with Axivion's axivion_ci.exe running MSBuild, where every call is 330 to 470 characters. The exit code is 3221225477 (0xC0000005). Depending on what the overflow hits, the crash comes before the program runs or after it has finished. In parse_command_line_parameters the quoted line is probed as a single first parameter (search_command with fast=TRUE) to decide whether the quotes are stripped. Since the line contains a backslash, search_command takes the explicit-path branch: WCMD_get_fullpath on the whole line, then wcscpy of the part after the last backslash into stemofsearch[MAX_PATH] and of the rest into sc->path[MAX_PATH], with no length check (the no-path branch has one, WCMD_LINETOOLONG). Any quoted line over 260 characters overflows one of them and smashes wmain's frame. addr2line on the fault address gives wmain's return (wcmdmain.c:5015 in 11.18), the wcscpy variant of the crash points into search_command, and +relay shows the last calls in pop_batch_context. In master 9d17984f the copies are at wcmdmain.c lines 2035, 2058 and 2080. It does not show up from a shell, because wine cmd /c "..." has its argv re-quoted into a different shape. A batch file passes the line as is, hence the reproducer below. Reproducible: Always Steps to Reproduce: 1. Save this as repro.bat (the argument is 300 x followed by \y; any quoted line longer than 260 characters with a backslash in it does the same): @echo off cmd /c "C:\windows\system32\attrib.exe xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\y" echo inner cmd exit code %ERRORLEVEL% 2. wine cmd /c repro.bat The same happens from any Windows program that runs a command through cmd /c "..." with a long line, e.g. Python: subprocess.call('C:\\windows\\system32\\attrib.exe ' + 'x'*300 + '\\y', shell=True) Actual Results: inner cmd exit code -1073741819 The inner cmd.exe dies with an access violation (0xC0000005) every time. attrib is either not run at all, or has run and the crash comes when cmd returns. Expected Results: attrib runs and cmd returns its exit code. On Windows 11 the same repro.bat prints attrib's "Parameter format not correct -" and then "inner cmd exit code 0". Returning RETURN_CODE_CANT_LAUNCH from search_command when either piece does not fit into its buffer makes the probe in parse_command_line_parameters treat the line as "not a program" and fall back to the old quote handling, which is what it already does for any other unknown first word. With that change the reproducer prints "inner cmd exit code 0" and the MSBuild lines from the Python tool run; verified on 11.18 here. Found while running MSBuild-based tools under Wine; the crash is in cmd.exe itself (wcmdmain.c), not in the started program. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.