[PATCH 0/1] MR10293: Fix crashes when for_ctrl->set is empty

[Trent Waddington (＠trent.waddington)]

This trivial bat file will crash:

`for %%i in () do echo "no"`

Although it more often involves a variable expansion.

I did not succeed at attempts to modify the tests to reproduce the crash.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10293

[PATCH 1/1] cmd.exe: Fix crashes when for_ctrl->set is empty.

[Trent Waddington]

From: Trent Waddington <[e-mail]>

---
 programs/cmd/wcmdmain.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/programs/cmd/wcmdmain.c b/programs/cmd/wcmdmain.c
index 20e7eafaed4..ba1e4414ead 100644
--- a/programs/cmd/wcmdmain.c
+++ b/programs/cmd/wcmdmain.c
@@ -3512,7 +3512,7 @@ static BOOL rebuild_command_for(struct command_rebuild *rb, const CMD_NODE *node
 
     /* append variable and the rest */
     ret = ret && rebuild_sprintf(rb, L"%%%c in (", for_ctrl->variable_index) &&
-        rebuild_expand_and_append(rb, for_ctrl->set, rbflags.depth == 0) &&
+        (!for_ctrl->set || rebuild_expand_and_append(rb, for_ctrl->set, rbflags.depth == 0)) &&
         rebuild_append(rb, L") do ") &&
         rebuild_append_command(rb, node->do_block, new_rflags);
     if (ret && node->do_block->op == CMD_SINGLE)
@@ -4261,8 +4261,13 @@ static RETURN_CODE for_control_execute_fileset(CMD_FOR_CONTROL *for_ctrl, CMD_NO
     FILE *input;
     int i;
 
-    wcscpy(set, for_ctrl->set);
-    handleExpansion(set, TRUE);
+    if (for_ctrl->set)
+    {
+        wcscpy(set, for_ctrl->set);
+        handleExpansion(set, TRUE);
+    }
+    else
+        set[0] = L'\0';
 
     args = WCMD_skip_leading_spaces(set);
     for (len = wcslen(args); len && (args[len - 1] == L' ' || args[len - 1] == L'\t'); len--)
@@ -4334,8 +4339,14 @@ static RETURN_CODE for_control_execute_set(CMD_FOR_CONTROL *for_ctrl, const WCHA
     else
         len = 0;
 
-    wcscpy(set, for_ctrl->set);
-    handleExpansion(set, TRUE);
+    if (for_ctrl->set)
+    {
+        wcscpy(set, for_ctrl->set);
+        handleExpansion(set, TRUE);
+    }
+    else
+        set[0] = L'\0';
+
     for (i = 0; !WCMD_is_break(return_code); i++)
     {
         WCHAR *element = WCMD_parameter(set, i, NULL, TRUE, FALSE);
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/10293

[eric pouech (＠epo)]

it would be simpler IMO to set `for_ctrl->set` to an empty string at parsing time

tests shall be added (after changing the code as you won't be able to catch the crash in tests)

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10293#note_131801