[PATCH 1/1] shell32: Make sure wcmd has enough space to hold the string.

[Jiajin Cui]

From: Jiajin Cui

If the length of wszApplicationName exceeds 1024, it will cause an error
when writing to the subsequent stack space after exceeding the wcmd space,
Wcmd needs to be modified to dynamic allocation.

Signed-off-by: Jiajin Cui 
---
 dlls/shell32/shlexec.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c
index da2b5fdc2b0..43e965ca7d5 100644
--- a/dlls/shell32/shlexec.c
+++ b/dlls/shell32/shlexec.c
@@ -1764,6 +1764,14 @@ static BOOL SHELL_execute( LPSHELLEXECUTEINFOW sei, SHELL_ExecuteW32 execfunc )
     TRACE("execute:%s,%s,%s\n", debugstr_w(wszApplicationName), debugstr_w(wszParameters), debugstr_w(wszDir));
     lpFile = sei_tmp.lpFile;
     wcmd = wcmdBuffer;
+    len = lstrlenW(wszApplicationName) + 3;
+    if (sei_tmp.lpParameters[0])
+        len += 1 + lstrlenW(wszParameters);
+    if (len > wcmdLen)
+    {
+        wcmd = heap_alloc(len * sizeof(WCHAR));
+        wcmdLen = len;
+    }
     lstrcpyW(wcmd, wszApplicationName);
     if (sei_tmp.lpDirectory)
     {