Re: [PATCH v8 0/6] MR1857: Draft: comdlg32: IFileDialog navigation bar

[Esme Povirk (＠madewokherd)]

Esme Povirk (@madewokherd) commented about dlls/comdlg32/navbar.c:
> - INT len = 0, size;
> - WCHAR *text = NULL, *expanded = NULL;
> - DWORD expanded_cch;
> - ITEMIDLIST *pidl = NULL;
> - HRESULT hr;
> -
> - len = GetWindowTextLengthW(info->pathedit_hwnd);
> - if (!len)
> -
>    goto exit;
> -
> - size = (len + 1) * sizeof(WCHAR);
> - text = HeapAlloc(GetProcessHeap(), 0, size);
> - if (!text)
> -
>    goto exit;
> -
> - if (!GetWindowTextW(info->pathedit_hwnd, text, size))

According to MSDN, the last argument is the number of characters the buffer can accept, not the number of bytes, so this could overflow.