New subject: [Bug 60383] cmd: stack buffer overflow in search_command with a quoted /c command line longer than MAX_PATH

Sept. 25, 2026

      http://bugs.winehq.org/show_bug.cgi?id=60383

            Bug ID: 60383
           Summary: cmd: stack buffer overflow in search_command with a
                    quoted /c command line longer than MAX_PATH
           Product: Wine
           Version: unspecified
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: cmd
          Assignee: wine-bugs@list.winehq.org
          Reporter: dnlbtz@gmail.com
  Target Milestone: ---
      Distribution: ---

User-Agent:       Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/151.0.0.0 Safari/537.36
Build Identifier: Wine 11.18 (built from the release tarball,
--enable-archs=i386,x86_64); the affected code is unchanged in master 9d17984f
(2026-09-24)

cmd.exe crashes with an access violation when it is started as
cmd /c "<program> <arguments>" with the whole command line in one pair of
quotes, longer than MAX_PATH and containing a backslash. That is the form
Python's subprocess produces for shell=True on Windows, so any Python tool that
shells out long MSBuild or compiler lines under Wine hits it; I found it with
Axivion's axivion_ci.exe running MSBuild, where every call is 330 to 470
characters. The exit code is 3221225477 (0xC0000005). Depending on what the
overflow hits, the crash comes before the program runs or after it has
finished.

In parse_command_line_parameters the quoted line is probed as a single first
parameter (search_command with fast=TRUE) to decide whether the quotes are
stripped. Since the line contains a backslash, search_command takes the
explicit-path branch: WCMD_get_fullpath on the whole line, then wcscpy of the
part after the last backslash into stemofsearch[MAX_PATH] and of the rest into
sc->path[MAX_PATH], with no length check (the no-path branch has one,
WCMD_LINETOOLONG). Any quoted line over 260 characters overflows one of them
and smashes wmain's frame. addr2line on the fault address gives wmain's return
(wcmdmain.c:5015 in 11.18), the wcscpy variant of the crash points into
search_command, and +relay shows the last calls in pop_batch_context. In master
9d17984f the copies are at wcmdmain.c lines 2035, 2058 and 2080.

It does not show up from a shell, because wine cmd /c "..." has its argv
re-quoted into a different shape. A batch file passes the line as is, hence the
reproducer below.

Reproducible: Always

Steps to Reproduce:
1. Save this as repro.bat (the argument is 300 x followed by \y; any quoted
line longer than 260 characters with a backslash in it does the same):

@echo off
cmd /c "C:\windows\system32\attrib.exe
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\y"
echo inner cmd exit code %ERRORLEVEL%

2. wine cmd /c repro.bat

The same happens from any Windows program that runs a command through cmd /c
"..." with a long line, e.g. Python:
subprocess.call('C:\\windows\\system32\\attrib.exe ' + 'x'*300 + '\\y',
shell=True)
Actual Results:  
inner cmd exit code -1073741819

The inner cmd.exe dies with an access violation (0xC0000005) every time. attrib
is either not run at all, or has run and the crash comes when cmd returns.

Expected Results:  
attrib runs and cmd returns its exit code. On Windows 11 the same repro.bat
prints attrib's "Parameter format not correct -" and then "inner cmd exit code
0".

Returning RETURN_CODE_CANT_LAUNCH from search_command when either piece does
not fit into its buffer makes the probe in parse_command_line_parameters treat
the line as "not a program" and fall back to the old quote handling, which is
what it already does for any other unknown first word. With that change the
reproducer prints "inner cmd exit code 0" and the MSBuild lines from the Python
tool run; verified on 11.18 here.

Found while running MSBuild-based tools under Wine; the crash is in cmd.exe
itself (wcmdmain.c), not in the started program.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 60383] New: cmd: stack buffer overflow in search_command with a quoted /c command line longer than MAX_PATH

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

WineHQ Bugzilla

tags

participants (1)