Skip to content

Fix GH-25009: GetConsoleTitleW() buffer size passed in bytes - #25011

Closed
lazerg wants to merge 2 commits into
php:PHP-8.4from
lazerg:fix/gh-25009
Closed

lazerg wants to merge 2 commits into
php:PHP-8.4from
lazerg:fix/gh-25009

Conversation

@lazerg

@lazerg lazerg commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

get_ps_title() passed sizeof(ps_buffer_w) to GetConsoleTitleW(), but nSize is a count of characters, not bytes. That told the API the 260-wchar_t buffer could hold 520 characters, so a console title of 260 or more characters set by another process overflowed the stack buffer. This passes MAX_PATH, the buffer's real length, so long titles get truncated instead.

No test, since it needs a console title longer than PHP itself allows to set, which another process has to set on the same console.

Fixes #25009

Comment thread sapi/cli/ps_title.c
wchar_t ps_buffer_w[MAX_PATH];
char *tmp;

if (!(ps_buffer_cur_len = GetConsoleTitleW(ps_buffer_w, (DWORD)sizeof(ps_buffer_w)))) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer this such that the length of the buffer is only spelled out once:

Suggested change
if (!(ps_buffer_cur_len = GetConsoleTitleW(ps_buffer_w, (DWORD)sizeof(ps_buffer_w)))) {
if (!(ps_buffer_cur_len = GetConsoleTitleW(ps_buffer_w, (DWORD)(sizeof(ps_buffer_w) / sizeof(ps_buffer_w[0]))))) {

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in c82dd09, thanks.

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@ndossche ndossche closed this in 113bc87 Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants