[glib] W32: pass argc returned by CommandLineToArgvW() to to protect_wargv()



commit 7485abe4810dd72ab19b87e313cdc1f39685dbdd
Author: Edward E <develinthedetail gmail com>
Date:   Tue Sep 27 15:28:09 2016 +0000

    W32: pass argc returned by CommandLineToArgvW() to to protect_wargv()
    
    It turns out that CommandLineToArgvW() (at least on XP) doesn't end the argv
    pointer array with a NULL, but goes straight into argv[0] string data, as per
    MSDN. So gspawn-win32-helper.c:protect_wargv() counts argc too high and
    overflows.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=772054

 glib/gspawn-win32-helper.c |    8 +++-----
 1 files changed, 3 insertions(+), 5 deletions(-)
---
diff --git a/glib/gspawn-win32-helper.c b/glib/gspawn-win32-helper.c
index 2a3af47..c4697c5 100644
--- a/glib/gspawn-win32-helper.c
+++ b/glib/gspawn-win32-helper.c
@@ -70,14 +70,12 @@ write_err_and_exit (gint    fd,
 /* Copy of protect_argv that handles wchar_t strings */
 
 static gint
-protect_wargv (wchar_t  **wargv,
+protect_wargv (gint       argc,
+              wchar_t  **wargv,
               wchar_t ***new_wargv)
 {
   gint i;
-  gint argc = 0;
   
-  while (wargv[argc])
-    ++argc;
   *new_wargv = g_new (wchar_t *, argc+1);
 
   /* Quote each argv element if necessary, so that it will get
@@ -350,7 +348,7 @@ main (int ignored_argc, char **ignored_argv)
   /* For the program name passed to spawnv(), don't use the quoted
    * version.
    */
-  protect_wargv (wargv + argv_zero_offset, &new_wargv);
+  protect_wargv (argc, wargv + argv_zero_offset, &new_wargv);
 
   if (argv[ARG_USE_PATH][0] == 'y')
     handle = _wspawnvp (mode, wargv[ARG_PROGRAM], (const wchar_t **) new_wargv);


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]