https://bugs.winehq.org/show_bug.cgi?id=42731
Bug ID: 42731 Summary: stack overflow when .bat script variable has more than 256 characters Product: Wine Version: 2.3 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs@winehq.org Reporter: lucianposton@gmail.com Distribution: ---
Created attachment 57723 --> https://bugs.winehq.org/attachment.cgi?id=57723 bug demo
When a variable with more than (roughly) 256 characters in a .bat script is passed as a parameter, the script fails with the following error:
err:seh:setup_exception_record stack overflow 1408 bytes in thread 0009 eip 7bc4887d esp 00240db0 stack 0x240000-0x241000-0x340000
attached .bat file that demonstrates the bug
https://bugs.winehq.org/show_bug.cgi?id=42731
Lucian Poston lucianposton@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |lucianposton@gmail.com
https://bugs.winehq.org/show_bug.cgi?id=42731
Damjan Jovanovic damjan.jov@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Ever confirmed|0 |1 Status|UNCONFIRMED |NEW CC| |damjan.jov@gmail.com
--- Comment #1 from Damjan Jovanovic damjan.jov@gmail.com --- A +cmd trace shows this just before the overflow:
00fc:trace:cmd:handleExpansion Translate command:L"REM -- 2 %~1" 0 (at: L"%~1") 00fc:trace:cmd:WCMD_HandleTildeModifiers Looking backwards for parameter id: L"1"
Deleting this line also stops it from crashing:
REM -- 2 %~1
https://bugs.winehq.org/show_bug.cgi?id=42731
Damjan Jovanovic damjan.jov@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |testcase Component|-unknown |cmd
--- Comment #2 from Damjan Jovanovic damjan.jov@gmail.com --- Some buffers in WCMD_HandleTildeModifiers() are only of size MAX_PATH, even though they handle strings that aren't necessarily files. When I change them to have size MAXSTRING, the crash doesn't happen.
https://bugs.winehq.org/show_bug.cgi?id=42731
Vijay Kamuju infyquest@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Fixed by SHA1| |abe848f05f5d91d4c8eb875ebbf | |143ca9ca9a210 CC| |infyquest@gmail.com Status|NEW |RESOLVED
--- Comment #3 from Vijay Kamuju infyquest@gmail.com --- fix now committed https://source.winehq.org/git/wine.git/commitdiff/abe848f05f5d91d4c8eb875ebb...
https://bugs.winehq.org/show_bug.cgi?id=42731
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #4 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 5.22.
https://bugs.winehq.org/show_bug.cgi?id=42731
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |5.0.x
https://bugs.winehq.org/show_bug.cgi?id=42731
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|5.0.x |---
--- Comment #5 from Michael Stefaniuc mstefani@winehq.org --- Removing the 5.0.x milestone from bug fixes included in 5.0.4.