Re: ole32: Fix invalid memory access in storage32

[Huw Davies]

Nathan Gallaher wrote:
> In StorageImpl_construct():
> For pwcsName strings shorter than DIRENTRY_NAME_BUFFER_LEN-1, an invalid
> read would be noted by valgrind as the memcpy wanders off the end of the
> string.  Do the needful to calculate the required string length.

By the way, in storage32.h the filename member of struct StorageBaseImpl is declared as
WCHAR filename[DIRENTRY_NAME_BUFFER_LEN];
shouldn't it be
WCHAR filename[DIRENTRY_NAME_MAX_LEN];
?

Huw.

ole32: Fix invalid memory access in storage32

[Nathan Gallaher]

On Sun, 6 Dec 2009, Huw Davies wrote:
> By the way, in storage32.h the filename member of struct StorageBaseImpl is 
> declared as
> WCHAR filename[DIRENTRY_NAME_BUFFER_LEN];
> shouldn't it be
> WCHAR filename[DIRENTRY_NAME_MAX_LEN];
> ?
>
> Huw.

Looking at it, I can't tell. Perhaps Vincent Povirk can explain, as that 
is his baby. What length it should be defined as is outside the scope of 
this patch anyway.

Thanks,
~Nate

ole32: Fix invalid memory access in storage32

[Vincent Povirk]

On Sun, Dec 6, 2009 at 8:12 AM, Huw Davies  wrote:
> By the way, in storage32.h the filename member of struct StorageBaseImpl is
> declared as
> WCHAR filename[DIRENTRY_NAME_BUFFER_LEN];
> shouldn't it be
> WCHAR filename[DIRENTRY_NAME_MAX_LEN];
> ?
>
> Huw.

I'm not sure. I think I copied it from the old code and wondered the same thing.

It really depends on how IStorage_Stat behaves for the root storage. I
suspect that there's no limit, or that the limit is MAX_PATH. I'm
planning to write a test for it.