https://git.reactos.org/?p=reactos.git;a=commitdiff;h=21b56d77c6286a2fef104ffd183e44eb117c2b2b

commit 21b56d77c6286a2fef104ffd183e44eb117c2b2b
Author:     Stanislav Motylkov <[email protected]>
AuthorDate: Tue Jul 21 19:50:45 2020 +0300
Commit:     Stanislav Motylkov <[email protected]>
CommitDate: Tue Jul 21 19:50:45 2020 +0300

    [EXPLORER] Allocate the string for expanded command line from heap
    
    Addendum to 6fe704b.
    
    CORE-12973 CORE-17168
---
 base/shell/explorer/startup.cpp | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/base/shell/explorer/startup.cpp b/base/shell/explorer/startup.cpp
index 5153deb9f13..9e6f60705c6 100644
--- a/base/shell/explorer/startup.cpp
+++ b/base/shell/explorer/startup.cpp
@@ -229,6 +229,7 @@ static BOOL ProcessRunKeys(HKEY hkRoot, LPCWSTR szKeyName, 
BOOL bDelete,
 
     while (i > 0)
     {
+        WCHAR *szCmdLineExp = NULL;
         DWORD cchValLength = cchMaxValue, cbDataLength = cbMaxCmdLine;
         DWORD type;
 
@@ -266,18 +267,37 @@ static BOOL ProcessRunKeys(HKEY hkRoot, LPCWSTR 
szKeyName, BOOL bDelete,
 
         if (type == REG_EXPAND_SZ)
         {
-            WCHAR szCmdLineExp[MAX_PATH + 1] = L"\0";
+            DWORD dwNumOfChars;
 
-            if (ExpandEnvironmentStringsW(szCmdLine, szCmdLineExp, 
_countof(szCmdLineExp)))
-                StringCbCopyW(szCmdLine, cbMaxCmdLine, szCmdLineExp);
+            dwNumOfChars = ExpandEnvironmentStringsW(szCmdLine, NULL, 0);
+            if (dwNumOfChars)
+            {
+                szCmdLineExp = (WCHAR *)HeapAlloc(hProcessHeap, 0, 
dwNumOfChars * sizeof(*szCmdLineExp));
+
+                if (szCmdLineExp == NULL)
+                {
+                    TRACE("Couldn't allocate memory for the commands to be 
executed\n");
+
+                    res = ERROR_NOT_ENOUGH_MEMORY;
+                    goto end;
+                }
+
+                ExpandEnvironmentStringsW(szCmdLine, szCmdLineExp, 
dwNumOfChars);
+            }
         }
 
-        res = runCmd(szCmdLine, NULL, bSynchronous, FALSE);
+        res = runCmd(szCmdLineExp ? szCmdLineExp : szCmdLine, NULL, 
bSynchronous, FALSE);
         if (res == INVALID_RUNCMD_RETURN)
         {
             TRACE("Error running cmd #%lu (%lu)\n", i, GetLastError());
         }
 
+        if (szCmdLineExp != NULL)
+        {
+            HeapFree(hProcessHeap, 0, szCmdLineExp);
+            szCmdLineExp = NULL;
+        }
+
         TRACE("Done processing cmd #%lu\n", i);
     }
 

Reply via email to