rapid7/metasploit-framework — pull request #122 by argp (2012-01-23 08:41:22+00:00)
Title: bug fix for hardcoded max command length

The bug was in the hardcoded max command length (30 or 0x1e) used in the repne movsb instruction:

B91E000000 mov ecx, 0x1e
FC cld
F2A4 repne movsb

Therefore, when the CMD parameter was longer than 30 characters, only the first 30 characters were copied.

My submitted fix uses Rex::Arch::X86.pack_word() to patch the shellcode with the length of the user provided CMD.