[PATCH 0/2] MR3981: shell32: Better handle long URLs.

[Paul Gofman (＠gofman)]

Currently ShellExecuteA() doesn't work for opening very long (>1024 chars) URLs. Commit fbf9cf6ebadc7d50c8fb7a130851c3658607b343 ("shell32: Make sure wcmd has enough space to hold the string.") started fixing it, but that is not enough.

This MR fixes two other issues on the way and lets ShellExecuteA() actually started winebrowser (with default registry) with the URL correctly relayed.

[PATCH 1/2] shell32: Avoid stack corruption with long name in SHELL_TryAppPathW().

[Paul Gofman]

From: Paul Gofman

---
 dlls/shell32/shlexec.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c
index ae61c923037..4b943d69637 100644
--- a/dlls/shell32/shlexec.c
+++ b/dlls/shell32/shlexec.c
@@ -428,8 +428,14 @@ static BOOL SHELL_TryAppPathW( LPCWSTR szName, LPWSTR lpResult, WCHAR **env)
     BOOL found = FALSE;

if (env) *env = NULL;
-    lstrcpyW(buffer, L"Software\Microsoft\Windows\CurrentVersion\App Paths\");
-    lstrcatW(buffer, szName);
+    wcscpy(buffer, L"Software\Microsoft\Windows\CurrentVersion\App Paths\");
+    if (wcslen(buffer) + wcslen(szName) + 1 > ARRAY_SIZE(buffer))
+    {
+        WARN("Name is too big.\n");
+        return FALSE;
+    }
+
+    wcscat(buffer, szName);
     res = RegOpenKeyExW(HKEY_LOCAL_MACHINE, buffer, 0, KEY_READ, &hkApp);
     if (res) goto end;

[PATCH 2/2] shell32: Handle long command line in execute_from_key().

[Paul Gofman]

From: Paul Gofman

---
 dlls/shell32/shlexec.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/dlls/shell32/shlexec.c b/dlls/shell32/shlexec.c
index 4b943d69637..d5486ebae92 100644
--- a/dlls/shell32/shlexec.c
+++ b/dlls/shell32/shlexec.c
@@ -965,7 +965,7 @@ static UINT_PTR execute_from_key(LPCWSTR key, LPCWSTR lpFile, WCHAR *env, LPCWST
    		     SHELL_ExecuteW32 execfunc,
                              LPSHELLEXECUTEINFOW psei, LPSHELLEXECUTEINFOW psei_out)
 {
-    WCHAR cmd[256], param[1024], ddeexec[256];
+    WCHAR cmd[256], parambuffer[1024], ddeexec[256], *param = parambuffer;
     LONG cmdlen = sizeof(cmd), ddeexeclen = sizeof(ddeexec);
     UINT_PTR retval = SE_ERR_NOASSOC;
     DWORD resultLen;
@@ -987,9 +987,14 @@ static UINT_PTR execute_from_key(LPCWSTR key, LPCWSTR lpFile, WCHAR *env, LPCWST
         if (cmdlen >= ARRAY_SIZE(cmd))
             cmdlen = ARRAY_SIZE(cmd) - 1;
         cmd[cmdlen] = '\0';
-        SHELL_ArgifyW(param, ARRAY_SIZE(param), cmd, lpFile, psei->lpIDList, szCommandline, &resultLen);
-        if (resultLen > ARRAY_SIZE(param))
-            ERR("Argify buffer not large enough, truncating\n");
+        SHELL_ArgifyW(param, ARRAY_SIZE(parambuffer), cmd, lpFile, psei->lpIDList, szCommandline, &resultLen);
+        if (resultLen > ARRAY_SIZE(parambuffer))
+        {
+            if ((param = malloc(resultLen * sizeof(*param))))
+                SHELL_ArgifyW(param, resultLen, cmd, lpFile, psei->lpIDList, szCommandline, &resultLen);
+            else
+                ERR("No memory.");
+        }
     }

/* Get the parameters needed by the application
@@ -1012,6 +1017,7 @@ static UINT_PTR execute_from_key(LPCWSTR key, LPCWSTR lpFile, WCHAR *env, LPCWST
     else
         WARN("Nothing appropriate found for %s\n", debugstr_w(key));

+    if (param != parambuffer) free(param);
     return retval;
 }