1 files changed, 86 insertions, 1 deletions
diff --git a/win/packaging/ca/CustomAction.cpp b/win/packaging/ca/CustomAction.cpp
index ed26dd45a94..50b39adc0b1 100644
--- a/win/packaging/ca/CustomAction.cpp
+++ b/win/packaging/ca/CustomAction.cpp
@@ -73,6 +73,82 @@ LExit:
   return WcaFinalize(er); 
 }
 
+/*
+  Escape command line parameter fpr pass to CreateProcess().
+
+  We assume out has enough space to include encoded string 
+  2*wcslen(in) is enough.
+
+  It is assumed that called will add double quotation marks before and after
+  the string.
+*/
+static void EscapeCommandLine(const wchar_t *in, wchar_t *out, size_t buflen)
+{
+  const wchar_t special_chars[]=L" \t\n\v\"";
+  bool needs_escaping= false;
+  size_t pos;
+
+  for(int i=0; i< sizeof(special_chars) -1; i++)
+  {
+    if (wcschr(in, special_chars[i]))
+    {
+      needs_escaping = true;
+      break;
+    }
+  }
+
+  if(!needs_escaping)
+  {
+    wcscpy_s(out, buflen, in);
+    return;
+  }
+
+  pos= 0;
+  for(int i = 0 ; ; i++) 
+  {
+    size_t n_backslashes = 0;
+    wchar_t c;
+    while (in[i] == L'\\') 
+    {
+      i++;
+      n_backslashes++;
+    }
+
+    c= in[i];
+    if (c == 0) 
+    {
+      /*
+        Escape all backslashes, but let the terminating double quotation mark 
+        that caller adds be interpreted as a metacharacter.
+      */
+      for(size_t j= 0; j < 2*n_backslashes;j++)
+      {
+        out[pos++]=L'\\';
+      }
+      break;
+    }
+    else if (c == L'"') 
+    {
+      /*
+        Escape all backslashes and the following double quotation mark.
+      */
+      for(size_t j= 0; j < 2*n_backslashes + 1; j++)
+      {
+        out[pos++]=L'\\';
+      }
+      out[pos++]= L'"';
+    }
+    else 
+    {
+      /* Backslashes aren't special here. */
+      for (size_t j=0; j < n_backslashes; j++)
+        out[pos++] = L'\\';
+
+      out[pos++]= c;
+    }
+  }
+  out[pos++]= 0;
+}
 /* 
   Check for if directory is empty during install, 
   sets "<PROPERTY>_NOT_EMPTY" otherise
@@ -462,6 +538,8 @@ unsigned long long GetMaxBufferSize(unsigned long long totalPhys)
   return totalPhys;
 #endif
 }
+
+
 /*
   Checks SERVICENAME, PORT and BUFFERSIZE parameters 
 */
@@ -470,6 +548,8 @@ extern "C" UINT  __stdcall CheckDatabaseProperties (MSIHANDLE hInstall)
   wchar_t ServiceName[MAX_PATH]={0};
   wchar_t SkipNetworking[MAX_PATH]={0};
   wchar_t QuickConfig[MAX_PATH]={0};
+  wchar_t Password[MAX_PATH]={0};
+  wchar_t EscapedPassword[2*MAX_PATH+2];
   wchar_t Port[6];
   wchar_t BufferPoolSize[16];
   DWORD PortLen=6;
@@ -512,8 +592,13 @@ extern "C" UINT  __stdcall CheckDatabaseProperties (MSIHANDLE hInstall)
     }
   }
 
-  DWORD SkipNetworkingLen= MAX_PATH;
+  DWORD PasswordLen= MAX_PATH;
+  MsiGetPropertyW (hInstall, L"PASSWORD", Password, &PasswordLen);
+  EscapeCommandLine(Password, EscapedPassword,
+    sizeof(EscapedPassword)/sizeof(EscapedPassword[0]));
+  MsiSetPropertyW(hInstall,L"ESCAPEDPASSWORD",EscapedPassword);
 
+  DWORD SkipNetworkingLen= MAX_PATH;
   MsiGetPropertyW(hInstall, L"SKIPNETWORKING", SkipNetworking, 
     &SkipNetworkingLen);
   MsiGetPropertyW(hInstall, L"PORT", Port, &PortLen);