[PATCH v2 1/2] comdlg32: Fix buffer overflow when current_filter is longer than MAX_PATH.

[Charlotte Pabst]

From: Charlotte Pabst

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57293
---
 dlls/comdlg32/itemdlg.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/dlls/comdlg32/itemdlg.c b/dlls/comdlg32/itemdlg.c
index 439a6b2214a..99af524a06f 100644
--- a/dlls/comdlg32/itemdlg.c
+++ b/dlls/comdlg32/itemdlg.c
@@ -558,10 +558,17 @@ static void fill_filename_from_selection(FileDialogImpl *This)
 static LPWSTR get_first_ext_from_spec(LPWSTR buf, LPCWSTR spec)
 {
     WCHAR *endpos, *ext;
+    INT len;

-    lstrcpyW(buf, spec);
-    if( (endpos = StrChrW(buf, ';')) )
-        *endpos = '\0';
+    if( (endpos = StrChrW(spec, ';')) )
+        len = endpos-spec+1;
+    else
+        len = lstrlenW(spec)+1;
+
+    if (len > MAX_PATH)
+        return NULL;
+
+    lstrcpynW(buf, spec, len);

ext = PathFindExtensionW(buf);
     if(StrChrW(ext, '*'))