Fix unchecked configuration-path copies and wide-character buffer capacities in launcher

The issue points to specific lines in launcher/src/CmderLauncher.cpp: GetOption (line 632), StartCmder (lines 151-152), and RegisterShellMenu (lines 549-550). Review these functions to understand the unsafe string copies into fixed-size arrays. Also check the calls to GetModuleFileName at lines 154 and 533 for buffer capacity issues. The fix involves validating path lengths before copying and using dynamic strings or safe copy functions. Testing requires a Windows environment to simulate long configuration paths.

Summary

The launcher copies the /c configuration-root argument into fixed-size stack arrays without checking its length. This is a memory-safety defect, distinct from the bounded command-line formatting failure discussed in #2775 and the hardening work in #3117.

Severity: Medium. Confidence: High from source inspection. Reviewed commit: 1d6777b5c087c7e31ab9b2a1237276c9fe8a0d3a. Windows reproduction was not available; arbitrary code execution is not established.

Code path

• GetOption, line 632 accepts the argument without a length limit.
• StartCmder, lines 151–152 copies it into userConfigDirPath[MAX_PATH] and writes a terminator at cfgRoot.length().
• RegisterShellMenu, lines 549–550 repeats the unchecked copy.

At length 260 the terminator is out of bounds; larger values also overrun the copy. The path need not exist before the write.

Related capacity errors: GetModuleFileName at line 154 and line 533 receives sizeof(wchar_array) even though the API expects a character count. Long executable-path reachability has not been tested.

Scenario and impact

A launcher integration or crafted shortcut supplies an oversized configuration-root argument. This causes stack corruption and can terminate the launcher. Attacker control of the invocation is required; this report does not claim remote exploitation or privilege escalation.

Recommended correction

Keep paths in dynamically sized strings where possible. Otherwise validate lengths before copying, reserving space for the terminator. Pass _countof(array) to wide-character Windows APIs and handle errors/truncation explicitly.

Validation to add

On a Windows test runner, exercise configuration-root lengths 259, 260, 261 and larger through both startup and registration argument handling, with memory-safety instrumentation where available. Oversized input should produce a controlled error before configuration or registry writes. Check long executable paths and retain ordinary startup/registration behavior.