[PATCH 0/1] MR1981: shell32: Handle NULL sPathTarget in all places before copying it.

[Gabriel Ivăncescu]

This can crash if you parse, for example, "/" with the desktop IShellFolder.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1981

[PATCH 1/1] shell32: Handle NULL sPathTarget in all places before copying it.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu <gabrielopcode(a)gmail.com>

Currently it's only checked in some places.

Signed-off-by: Gabriel Ivăncescu <gabrielopcode(a)gmail.com>
---

This can crash if you parse, for example, "/" with the desktop IShellFolder.
---
 dlls/shell32/shfldr_fs.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/dlls/shell32/shfldr_fs.c b/dlls/shell32/shfldr_fs.c
index 662d8b52d5b..762444c6410 100644
--- a/dlls/shell32/shfldr_fs.c
+++ b/dlls/shell32/shfldr_fs.c
@@ -325,7 +325,9 @@ IShellFolder_fnParseDisplayName (IShellFolder2 * iface,
     if (*lpszDisplayName)
     {
         /* build the full pathname to the element */
-        lstrcpynW(szPath, This->sPathTarget, MAX_PATH - 1);
+        szPath[0] = '\0';
+        if (This->sPathTarget)
+            lstrcpynW(szPath, This->sPathTarget, MAX_PATH - 1);
         PathAddBackslashW(szPath);
         len = lstrlenW(szPath);
         /* get the next element */
@@ -939,12 +941,16 @@ static HRESULT WINAPI IShellFolder_fnSetNameOf (IShellFolder2 * iface,
     if (wcspbrk( lpName, L"\\/:*?\"<>|" )) return HRESULT_FROM_WIN32(ERROR_CANCELLED);
 
     /* build source path */
-    lstrcpynW(szSrc, This->sPathTarget, MAX_PATH);
+    szSrc[0] = '\0';
+    if (This->sPathTarget)
+        lstrcpynW(szSrc, This->sPathTarget, MAX_PATH);
     ptr = PathAddBackslashW (szSrc);
     _ILSimpleGetTextW (pidl, ptr, MAX_PATH + 1 - (ptr - szSrc));
 
     /* build destination path */
-    lstrcpynW(szDest, This->sPathTarget, MAX_PATH);
+    szDest[0] = '\0';
+    if (This->sPathTarget)
+        lstrcpynW(szDest, This->sPathTarget, MAX_PATH);
     ptr = PathAddBackslashW (szDest);
     lstrcpynW(ptr, lpName, MAX_PATH + 1 - (ptr - szDest));
 
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/1981

[PATCH 0/1] MR1981: shell32: Handle NULL sPathTarget in all places before copying it. - closed

[Gabriel Ivăncescu]

This merge request was closed by Gabriel Ivăncescu.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1981

[Gabriel Ivăncescu]

Superseded by !5225

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1981#note_64588