[PATCH v2 0/2] MR8197: cmd: Fix two parsing OOBs

[Yuxuan Shui (＠yshui)]

--
  v2: cmd: Don't check for quotes past the start of the command.
      cmd: Fix out-of-bound access when parsing commands that start with >.

https://gitlab.winehq.org/wine/wine/-/merge_requests/8197

[PATCH v2 1/2] cmd: Fix out-of-bound access when parsing commands that start with >.

[Yuxuan Shui]

From: Yuxuan Shui

---
 programs/cmd/wcmdmain.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/programs/cmd/wcmdmain.c b/programs/cmd/wcmdmain.c
index e51f7cb7781..61e70312b8f 100644
--- a/programs/cmd/wcmdmain.c
+++ b/programs/cmd/wcmdmain.c
@@ -3398,7 +3398,8 @@ enum read_parse_line WCMD_ReadAndParseLine(const WCHAR *optionalcmd, CMD_NODE **
           /* See if 1>, 2> etc, in which case we have some patching up
              to do (provided there's a preceding whitespace, and enough
              chars read so far) */
-          if (curPos[-1] >= L'1' && curPos[-1] <= L'9' && (curStringLen == 1 || iswspace(curPos[-2])))
+          if (curPos > extraSpace && curPos[-1] >= L'1' && curPos[-1] <= L'9' &&
+              (curStringLen == 1 || (curPos > extraSpace + 1 && iswspace(curPos[-2]))))
           {
               curStringLen--;
               curString[curStringLen] = L'\0';

[PATCH v2 2/2] cmd: Don't check for quotes past the start of the command.

[Yuxuan Shui]

From: Yuxuan Shui

---
 programs/cmd/wcmdmain.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/programs/cmd/wcmdmain.c b/programs/cmd/wcmdmain.c
index 61e70312b8f..5275bf3a7fb 100644
--- a/programs/cmd/wcmdmain.c
+++ b/programs/cmd/wcmdmain.c
@@ -2045,7 +2045,7 @@ static RETURN_CODE search_command(WCHAR *command, struct search_command *sc, BOO

/* Remove quotes */
             length = wcslen(sc->path);
-            if (sc->path[length - 1] == L'"')
+            if (length && sc->path[length - 1] == L'"')
                 sc->path[length - 1] = 0;

if (*sc->path != L'"')

[Yuxuan Shui (＠yshui)]

oh i think i am supposed to use `curStringLen`, aren't i?