[cmd] rmdir issues error during recursive delete

[Ann and Jason Edmeades]

rmdir uses SHFileOperation to remove the directory and its contents
but fails to terminate with a double null, meaning it attempts to
access beyond the first null terminator (for subsequent supplied
filenames) and attempts to remove garbage.

[BUG 28365]

(Note: The test is minimal as we already exercised this but threw
away the error message which went to stderr, as the batch tests
only compare the stdout text. By redirecting the error message to
stdout, it highlights the problem.)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winehq.org/pipermail/wine-patches/attachments/20120903/615d330d/attachment.html>
-------------- next part --------------
From 82b5231461436bf1ce9dafe1d90719ba66525f8b Mon Sep 17 00:00:00 2001
From: Jason Edmeades <us at edmeades.me.uk>
Date: Mon, 3 Sep 2012 22:03:58 +0100
Subject: [PATCH] [cmd] rmdir issues error during recursive delete

rmdir uses SHFileOperation to remove the directory and its contents
but fails to terminate with a double null, meaning it attempts to
access beyond the first null terminator (for subsequent supplied
filenames) and attempts to remove garbage.

[BUG 28365]

(Note: The test is minimal as we already exercised this but threw
away the error message which went to stderr, as the batch tests
only compare the stdout text. By redirecting the error message to
stdout, it highlights the problem.)
---
 programs/cmd/builtins.c              |    4 ++++
 programs/cmd/tests/test_builtins.cmd |    2 +-
 2 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/programs/cmd/builtins.c b/programs/cmd/builtins.c
index a83947b..c92822b 100644
--- a/programs/cmd/builtins.c
+++ b/programs/cmd/builtins.c
@@ -1827,6 +1827,10 @@ void WCMD_remove_dir (WCHAR *command) {
         lpDir.pFrom  = thisArg;
         lpDir.fFlags = FOF_SILENT | FOF_NOCONFIRMATION | FOF_NOERRORUI;
         lpDir.wFunc  = FO_DELETE;
+
+        /* SHFileOperationW needs file list with a double null termination */
+        thisArg[lstrlenW(thisArg) + 1] = 0x00;
+
         if (SHFileOperationW(&lpDir)) WCMD_print_error ();
       }
     }
diff --git a/programs/cmd/tests/test_builtins.cmd b/programs/cmd/tests/test_builtins.cmd
index 36bc73f..13b53c5 100644
--- a/programs/cmd/tests/test_builtins.cmd
+++ b/programs/cmd/tests/test_builtins.cmd
@@ -1163,7 +1163,7 @@ if not exist foo (
 )
 mkdir foo\bar\baz
 echo foo > foo\bar\brol
-rmdir /s /Q foo
+rmdir /s /Q foo 2>&1
 if not exist foo (
     echo recursive rmdir succeeded
 ) else (
-- 
1.7.5.4