Paul Gofman : shell32: Avoid stack corruption with long name in SHELL_TryAppPathW().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f1c57f06d66d61c423c7b842cce3368817663c51
URL:    https://gitlab.winehq.org/wine/wine/-/commit/f1c57f06d66d61c423c7b842cce3368...

Author: Paul Gofman <pgofman(a)codeweavers.com>
Date:   Thu Sep 28 19:29:03 2023 -0600

shell32: Avoid stack corruption with long name in SHELL_TryAppPathW().

---

 dlls/shell32/shlexec.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c
index ae61c923037..4b943d69637 100644
--- a/dlls/shell32/shlexec.c
+++ b/dlls/shell32/shlexec.c
@@ -428,8 +428,14 @@ static BOOL SHELL_TryAppPathW( LPCWSTR szName, LPWSTR lpResult, WCHAR **env)
     BOOL found = FALSE;
 
     if (env) *env = NULL;
-    lstrcpyW(buffer, L"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\");
-    lstrcatW(buffer, szName);
+    wcscpy(buffer, L"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\");
+    if (wcslen(buffer) + wcslen(szName) + 1 > ARRAY_SIZE(buffer))
+    {
+        WARN("Name is too big.\n");
+        return FALSE;
+    }
+
+    wcscat(buffer, szName);
     res = RegOpenKeyExW(HKEY_LOCAL_MACHINE, buffer, 0, KEY_READ, &hkApp);
     if (res) goto end;