luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-12-23 16:29:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

W32: pass argc returned by CommandLineToArgvW() to to protect_wargv()

Browse Source 
It turns out that CommandLineToArgvW() (at least on XP) doesn't end the argv
pointer array with a NULL, but goes straight into argv[0] string data, as per
MSDN. So gspawn-win32-helper.c:protect_wargv() counts argc too high and
overflows.

https://bugzilla.gnome.org/show_bug.cgi?id=772054
This commit is contained in:
Edward E
2016-09-27 15:28:09 +00:00
committed by Руслан Ижбулатов
parent 34751ad17a
commit 7485abe481
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
glib/gspawn-win32-helper.c
View File

@@ -70,14 +70,12 @@ write_err_and_exit (gint fd,
/* Copy of protect_argv that handles wchar_t strings */ /* Copy of protect_argv that handles wchar_t strings */
static gint static gint
protect_wargv (wchar_t **wargv, protect_wargv (gint argc,
wchar_t **wargv,
wchar_t ***new_wargv) wchar_t ***new_wargv)
{ {
gint i; gint i;
gint argc = 0;
while (wargv[argc])
++argc;
*new_wargv = g_new (wchar_t *, argc+1); *new_wargv = g_new (wchar_t *, argc+1);
/* Quote each argv element if necessary, so that it will get /* Quote each argv element if necessary, so that it will get
@@ -350,7 +348,7 @@ main (int ignored_argc, char **ignored_argv)
/* For the program name passed to spawnv(), don't use the quoted /* For the program name passed to spawnv(), don't use the quoted
* version. * version.
*/ */
protect_wargv (wargv + argv_zero_offset, &new_wargv); protect_wargv (argc, wargv + argv_zero_offset, &new_wargv);
if (argv[ARG_USE_PATH][0] == 'y') if (argv[ARG_USE_PATH][0] == 'y')
handle = _wspawnvp (mode, wargv[ARG_PROGRAM], (const wchar_t **) new_wargv); handle = _wspawnvp (mode, wargv[ARG_PROGRAM], (const wchar_t **) new_wargv);