VideoLAN VLC Media Player <= 2.0.4 Crash Bug

[bingxuefenggu () 126 com]

poc: 

This crash will be triggered by a special file name.

we can rename the normal file name to make sure that the length of absolute path is a odd number.Then we add the file 
to the vlc player, it will crash. 

Reason:

When this program call the function SHAddToRecentDocs without a unicode parameter,it will crash.

This is because it will bypass the '\x00' at the end of string during the  calculations of the string's length using 
the 'lstrlenw'.

The windbg result:
(we can see the file path in the memory is not the unicode)
#(1100.158c): Access violation – code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=17339000 ebx=0a1abb1c ecx=1733d000 edx=17338fe2 esi=00000000 edi=00000000
#eip=754f7240 esp=0a1abab8 ebp=0a1abae0 iopl=0         nv up ei ng nz na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210286
#KERNELBASE!lstrlenW+0x1a:
#754f7240 668b08          mov     cx,word ptr [eax]        ds:0023:17339000=????
#0:002> dc eax-40
#17338fc0  abcdbbbb 017f1000 0000001f 00001000  …………….
#17338fd0  00000000 00000000 004755c4 dcbabbbb  ………UG…..
#17338fe0  555c3a43 73726573 6573755c 65445c72  C:UsersuserDe
#17338ff0  6f746b73 31315c70 6e702e31 d0000067  sktop111.png…
#17339000  ???????? ???????? ???????? ????????  ????????????????
#17339010  ???????? ???????? ???????? ????????  ????????????????
#17339020  ???????? ???????? ???????? ????????  ????????????????
#17339030  ???????? ???????? ???????? ????????  ????????????????
#0:002> kb
#ChildEBP RetAddr  Args to Child
#0a1abae0 7692ae5d 17338fe0 00000000 00000000 KERNELBASE!lstrlenW+0x1a
#0a1abaf8 75c41a88 17338fe0 0a1abb1c 00000000 SHLWAPI!SHStrDupW+0×24
#0a1abb30 75cd6bbd 17338fe0 191c8fc8 0a1abba8 SHELL32!SHParseDisplayName+0×39
#0a1abb78 75cd6b32 17338fe0 0a1abba8 191a9fc0 SHELL32!ParseRecentDoc+0×58
#*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:Program 
FilesVideoLANVLCpluginsguilibqt4_plugin.dll -
#0a1acbf8 65f44c93 00000003 17338fe0 6687ce2c SHELL32!SHAddToRecentDocs+0xb5
------------------------------------------------------------------------------