src/windows/native/java/lang/ProcessImpl_md.c

@@ -61,50 +61,56 @@
         return source;
     *p = 0;
     return source;
 }
 
+static const char EXE_EXT[] = ".exe";
+
 DWORD
 selectProcessFlag(JNIEnv *env, jstring cmd0)
 {
-    char buf[MAX_PATH];
     DWORD newFlag = 0;
-    char *exe, *p, *name;
-    unsigned char buffer[2];
-    long headerLoc = 0;
-    int fd = 0;
-
-    exe = (char *)JNU_GetStringPlatformChars(env, cmd0, 0);
+    char *exe = (char *)JNU_GetStringPlatformChars(env, cmd0, 0);
+    if (exe != NULL) {
+        char buf[MAX_PATH];
+        char *name;
+        DWORD len;
     exe = extractExecutablePath(env, exe);
-
     if (exe != NULL) {
-        if ((p = strchr(exe, '\\')) == NULL) {
-            SearchPath(NULL, exe, ".exe", MAX_PATH, buf, &name);
+            /*we are here for Win9x/Me, so the [/] is not the path sep*/
+            char *p = strrchr(exe, '\\');
+            if (p == NULL) {
+                len = SearchPath(NULL, exe, EXE_EXT, MAX_PATH, buf, &name);
         } else {
-            p = strrchr(exe, '\\');
             *p = 0;
-            p++;
-            SearchPath(exe, p, ".exe", MAX_PATH, buf, &name);
+                len = SearchPath(exe, p + 1, EXE_EXT, MAX_PATH, buf, &name);
         }
     }
 
-    fd = _open(buf, _O_RDONLY);
-    if (fd > 0) {
-        _read(fd, buffer, 2);
-        if (buffer[0] == 'M' && buffer[1] == 'Z') {
-            _lseek(fd, 60L, SEEK_SET);
-            _read(fd, buffer, 2);
-            headerLoc = (long)buffer[1] << 8 | (long)buffer[0];
-            _lseek(fd, headerLoc, SEEK_SET);
-            _read(fd, buffer, 2);
-            if (buffer[0] == 'P' && buffer[1] == 'E') {
+        if (len > 0 && len < MAX_PATH) {
+            /*here the [buf] path is null terminated*/
+            int fd = _open(buf, _O_RDONLY);
+            if (fd != -1) {
+                unsigned char buffer[2];
+                if (_read(fd, buffer, 2) == 2
+                    && buffer[0] == 'M' && buffer[1] == 'Z'
+                    && _lseek(fd, 60L, SEEK_SET) == 60L
+                    && _read(fd, buffer, 2) == 2)
+                {
+                    long headerLoc = (long)buffer[1] << 8 | (long)buffer[0];
+                    if (_lseek(fd, headerLoc, SEEK_SET) == headerLoc
+                        && _read(fd, buffer, 2) == 2
+                        && buffer[0] == 'P' && buffer[1] == 'E')
+                    {
                 newFlag = DETACHED_PROCESS;
             }
         }
         _close(fd);
     }
+        }
     JNU_ReleaseStringPlatformChars(env, cmd0, exe);
+    }
     return newFlag;
 }
 
 static void
 win32Error(JNIEnv *env, const char *functionName)