Re:Remote code execution vulnerability in ImageMagick
by ashitlerferad on Thursday May 05, 2016 @12:10AM
(#11633965)
It seems like CreateProcess uses the one-long-string for the command rather than the POSIX model of one string per argument. Is there any way to run a process on Windows using one string per argument?
[ Parent
| on HN ]
Re:Remote code execution vulnerability in ImageMagick
by JdeBP on Thursday May 05, 2016 @05:59AM
(#11634884)
Actually, it's (normally) two strings, one for the program image filename and one for the command tail.
* https://msdn.microsoft.com/en-gb/library/windows/desktop/ms6...
A single command tail is the Win32 model at base, as it was the DOS API model before it. (The OS/2 model was multiple command tails, although in practice most programs read no more than just one.) exec*() implementations are layered on top of this, and the argv[] notion is a shared fiction maintained by the runtime libraries of C and C++ implementations.