shell32: Fix security issue in SHELL_execute.

Alexandre Julliard julliard at winehq.org
Thu Feb 7 05:14:16 CST 2008


Robert Shearman <rob at codeweavers.com> writes:

> execfunc should not be called on files which aren't supposed to be
> executable.

This doesn't work:

../../../tools/runtest -q -P wine -M shell32.dll -T ../../.. -p shell32_test.exe.so shlexec.c && touch shlexec.ok
shlexec.c:971: Test failed: ShellExecuteEx(null, "C:\windows\temp\\test_shortcut_exe.lnk", null, null) failed: rc=31 err=2
shlexec.c:974: Test failed: argvA3 expected 'Lnk', got '(null)'
shlexec.c:1010: Test failed: ShellExecuteEx(null, "C:\windows\temp\\test_shortcut_exe.lnk", ""C:\windows\temp\\nonexistent.shlexec"", null) failed: rc=31 err=2
shlexec.c:1010: Test failed: ShellExecuteEx(null, "C:\windows\temp\\test_shortcut_exe.lnk", ""C:\windows\temp\\nonexistent.noassoc"", null) failed: rc=31 err=2
shlexec.c:1010: Test failed: ShellExecuteEx(null, "C:\windows\temp\\test_shortcut_exe.lnk", ""C:\windows\temp\\test file.shlexec"", null) failed: rc=31 err=2
shlexec.c:1010: Test failed: ShellExecuteEx(null, "C:\windows\temp\\test_shortcut_exe.lnk", ""C:\windows\temp\/%nasty% $file.shlexec"", null) failed: rc=31 err=2
shlexec.c:1010: Test failed: ShellExecuteEx(null, "C:\windows\temp\\test_shortcut_exe.lnk", ""C:\windows\temp\\test file.noassoc"", null) failed: rc=31 err=2
shlexec.c:1062: Test failed: ShellExecuteEx(null, "Z:\home\julliard\wine\wine\dlls\shell32\tests\shell32_test.exe.so", "shlexec "C:\windows\temp\wt51f.tmp" Exec", null) returned 31
shlexec.c:1064: Test failed: argvA3 expected 'Exec', got '(null)'
shlexec.c:1071: Test succeeded inside todo block: ShellExecute(null, "C:\windows\temp\\test file.noassoc", "shlexec "C:\windows\temp\wt51f.tmp" Exec", null) succeeded: rc=31
shlexec.c:1093: Test failed: ShellExecuteEx(null, "Z:\home\julliard\wine\wine\dlls\shell32\tests\shell32_test.exe.so", "shlexec "C:\windows\temp\wt51f.tmp" abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxy", null) returned 31
shlexec.c:1095: Test failed: argvA3 expected 'abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxy', got '(null)'
shlexec.c:1102: Test succeeded inside todo block: ShellExecute(null, "C:\windows\temp\\test file.noassoc", "shlexec "C:\windows\temp\wt51f.tmp" abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxy", null) succeeded: rc=31
make: *** [shlexec.ok] Error 13

-- 
Alexandre Julliard
julliard at winehq.org



More information about the wine-devel mailing list