Jiajin Cui : shell32: Make sure wcmd has enough space to hold the string.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: eee640c93874317ab3ff62ca6afda962ac96d999
URL:    https://gitlab.winehq.org/wine/wine/-/commit/eee640c93874317ab3ff62ca6afda96...

Author: Jiajin Cui 
Date:   Wed Jun 21 17:53:52 2023 +0800

shell32: Make sure wcmd has enough space to hold the string.

If the length of wszApplicationName exceeds 1024, it will cause an error
when writing to the subsequent stack space after exceeding the wcmd space,
Wcmd needs to be modified to dynamic allocation.

Signed-off-by: Jiajin Cui

---

dlls/shell32/shlexec.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c
index da2b5fdc2b0..43e965ca7d5 100644
--- a/dlls/shell32/shlexec.c
+++ b/dlls/shell32/shlexec.c
@@ -1764,6 +1764,14 @@ static BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc )
     TRACE("execute:%s,%s,%s\n", debugstr_w(wszApplicationName), debugstr_w(wszParameters), debugstr_w(wszDir));
     lpFile = sei_tmp.lpFile;
     wcmd = wcmdBuffer;
+    len = lstrlenW(wszApplicationName) + 3;
+    if (sei_tmp.lpParameters[0])
+        len += 1 + lstrlenW(wszParameters);
+    if (len > wcmdLen)
+    {
+        wcmd = heap_alloc(len * sizeof(WCHAR));
+        wcmdLen = len;
+    }
     lstrcpyW(wcmd, wszApplicationName);
     if (sei_tmp.lpDirectory)
     {