Fix out-of-bounds read on trailing % in wxFileType::ExpandCommand()

A command ending in a bare '%' made the loop advance in this function
advance past the end of string.

Fix this by handling only non-trailing '%' specifically

Closes #26531.

src/common/mimecmn.cpp

@@ -138,7 +138,9 @@ wxString wxFileType::ExpandCommand(const wxString& command,
 
     wxString str;
     for ( const wxChar *pc = command.c_str(); *pc != wxT('\0'); pc++ ) {
-        if ( *pc == wxT('%') ) {
+        // Make sure to leave any trailing '%' alone to avoid going past the
+        // end of string.
+        if ( *pc == wxT('%') && pc[1] != wxT('\0') ) {
             switch ( *++pc ) {
                 case wxT('s'):
                     // don't quote the file name if it's already quoted: notice

tests/misc/misctests.cpp

@@ -262,6 +262,17 @@ TEST_CASE("wxFileTypeInfo", "[mime]")
         CHECK( fti.GetExtensions()[1] == "jpeg" );
     }
 }
+
+TEST_CASE("wxFileType::ExpandCommand", "[mime]")
+{
+    const wxFileType::MessageParameters params("file.txt", "text/plain");
+
+    CHECK( wxFileType::ExpandCommand("view %s", params) == "view file.txt" );
+
+    // A command ending with a bare '%' used to read past the end of the
+    // string; check that the trailing '%' is just copied verbatim instead.
+    CHECK( wxFileType::ExpandCommand("show %s %", params) == "show file.txt %" );
+}
 #endif // wxUSE_MIMETYPE
 
 TEST_CASE("wxVersionInfo", "[version]")