Pass ExpandEnvironmentStrings its buffer size in characters ##crash - #27302

• Mark this if you consider it ready to merge
• I've added tests (optional)
• I wrote some lines in the book (optional)

Description

r_sys_create_child_proc_w32 expands the command line into a buffer of 32768 TCHARs (max_length is in bytes), but passed max_length - 1 as nSize, which ExpandEnvironmentStrings reads as a number of characters. In UNICODE builds that allows 65535 characters into a 32768-character buffer, so a command line that expands to 32768 characters or more is written past the end of the heap buffer before CreateProcess rejects it. This affects the make-based mingw, msys and cygwin builds (mk/platform.mk adds -DUNICODE); meson/MSVC builds are ANSI, where the old size was right. It is reachable through r_sys_cmd_str.

The size is now passed in characters, and the command is not run when the expansion fails or does not fit.

Testing

I couldn't build radare2 for Windows here, and the Windows CI jobs don't run the unit tests, so I tested the function itself in a mingw-w64 harness (-DUNICODE), with a canary after each allocation. For a 40000-character command:

• master: writes 14466 bytes past the buffer.
• This change: writes nothing past it and returns false.

A short command runs the same in both. sys/lint.py --all is clean.