Skip to content

Commit 31df57e

Browse files
Updated C6277
Changed wording slightly, matched formatting and wording to my other PRs
1 parent 64857d3 commit 31df57e

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

docs/code-quality/c6277.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,17 @@ ms.assetid: 2b41252a-68c2-4e92-b005-0458db5f4430
99
---
1010
# C6277
1111

12-
> warning C6277: NULL application name with an unquoted path in call to \<function>: results in a security vulnerability if the path contains spaces
12+
**Warning C6277: CreateProcess Escape (CREATEPROCESS_ESCAPE)**\
13+
Example output:
14+
> NULL application name with an unquoted path in call to '\**function-name*': results in a security vulnerability if the path contains spaces
1315
14-
This warning indicates that the application name parameter is null and there might be spaces in the executable path name. In this case, unless the executable name is "fully qualified," there is likely to be a security problem. A malicious user might insert a rogue executable with the same name earlier in the path. To correct this warning, you can specify the application name instead of passing null or if you do pass null for the application name, use quotation marks around the executable path.
16+
## Description
17+
18+
This warning indicates that the application name parameter is null and that there might be spaces in the executable path name. Unless the executable name is "fully qualified," there is likely to be a security problem. A malicious user could insert a rogue executable with the same name earlier in the path. To correct this warning, you can specify the application name instead of passing null. Alternatively, if you do pass null for the application name, use quotation marks around the executable path.
1519

1620
## Example
1721

18-
The following sample code generates this warning because the application name parameter is null, and the executable path name has a space in it; there is a risk that a different executable could be run because of the way the function parses spaces. For more information, see [CreateProcess](/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createprocessa).
22+
The following sample code generates this warning. This issue stems from the application name parameter being NULL and from the executable path name having a space in it. Due to how the function parses spaces, there is a risk that a different executable could be run. For more information, see [CreateProcessA function (processthreadsapi.h)](/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createprocessa).
1923

2024
```cpp
2125
#include <windows.h>

0 commit comments

Comments
 (0)