From 57f1a5075fdf21da4587b68c1abce03570ced9cd Mon Sep 17 00:00:00 2001
From: yuanyuanxiang <962914132@qq.com>
Date: Fri, 30 Jan 2026 16:32:12 +0100
Subject: [PATCH] Fix: Dangling pointer when assigning _TR/_L result to LPCTSTR

_TR() and _L() return temporary CString objects. Assigning them
directly to raw pointer fields (m_ofn.lpstrTitle) causes use-after-free.
Use local CString variable to extend lifetime.
---
 server/2015Remote/2015RemoteDlg.cpp  | 3 ++-
 server/2015Remote/sys/MachineDlg.cpp | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/2015Remote/2015RemoteDlg.cpp b/server/2015Remote/2015RemoteDlg.cpp
index 99fa0f7..3aca9d9 100644
--- a/server/2015Remote/2015RemoteDlg.cpp
+++ b/server/2015Remote/2015RemoteDlg.cpp
@@ -4999,7 +4999,8 @@ void CMy2015RemoteDlg::OnChangeLang()
 void CMy2015RemoteDlg::OnChooseLangDir()
 {
     CFolderPickerDialog folderDlg(THIS_CFG.GetStr("settings", "LangDir", "./lang").c_str(), NULL, this, 0);
-    folderDlg.m_ofn.lpstrTitle = _TR("请选择目录");
+    CString strTitle = _TR("请选择目录");
+    folderDlg.m_ofn.lpstrTitle = strTitle;
 	if (folderDlg.DoModal() == IDOK)
 	{
 		CString folderPath = folderDlg.GetPathName();
diff --git a/server/2015Remote/sys/MachineDlg.cpp b/server/2015Remote/sys/MachineDlg.cpp
index ca4f1b1..d9a801c 100644
--- a/server/2015Remote/sys/MachineDlg.cpp
+++ b/server/2015Remote/sys/MachineDlg.cpp
@@ -1643,7 +1643,8 @@ void CMachineDlg::ShowHostsList_menu()
         LPBYTE lpBuffer = NULL;
         CFileDialog dlg(TRUE, _T("*.txt"), NULL, OFN_FILEMUSTEXIST | OFN_PATHMUSTEXIST | OFN_HIDEREADONLY,
                         _T("图片文件(*.txt;*.txt)|*.txt;*.txt| All Files (*.*) |*.*||"), NULL);
-        dlg.m_ofn.lpstrTitle = _L(_T("选择文件"));
+        CString strTitle = _L(_T("选择文件"));
+        dlg.m_ofn.lpstrTitle = strTitle;
 
         if (dlg.DoModal() != IDOK)
             break;