fenix
/
PDF4QT
mirror of https://github.com/JakubMelka/PDF4QT.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Issue #110: PDF4QT Viewer Lite : Arbitrary Code can execute when using Send by Email

This commit is contained in:
Jakub Melka 2023-11-21 19:43:04 +01:00
parent 851374dc73
commit ff6dd4b249
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Pdf4QtViewer/pdfsendmail.cpp
View File

@ -41,8 +41,22 @@ bool PDFSendMail::sendMail(QWidget* parent, QString subject, QString fileName)
std::wstring fileNameString = fileInfo.fileName().toStdWString(); std::wstring fileNameString = fileInfo.fileName().toStdWString();
std::wstring filePathString = QDir::toNativeSeparators(fileInfo.absoluteFilePath()).toStdWString(); std::wstring filePathString = QDir::toNativeSeparators(fileInfo.absoluteFilePath()).toStdWString();
std::array<wchar_t, MAX_PATH> systemDirectoryBuffer = { };
if (!::GetSystemDirectoryW(systemDirectoryBuffer.data(), uint(systemDirectoryBuffer.size())))
{
return false;
}
HMODULE mapiLib = ::LoadLibrary(L"MAPI32.DLL"); QString systemDirectory = QString::fromWCharArray(systemDirectoryBuffer.data());
QString mapiDllPath = QString("%1\\MAPI32.dll").arg(systemDirectory);
QFileInfo mapiDllPathInfo(mapiDllPath);
QString mapiDllPathCorrected = mapiDllPathInfo.absoluteFilePath();
std::vector<wchar_t> mapiDllPathWchar(mapiDllPathCorrected.size() + 1);
qsizetype length = mapiDllPathCorrected.toWCharArray(mapiDllPathWchar.data());
mapiDllPathWchar[length] = 0;
HMODULE mapiLib = ::LoadLibraryW(mapiDllPathWchar.data());
if (!mapiLib) if (!mapiLib)
{ {
return false; return false;