[PATCH 0/1] MR1981: shell32: Handle NULL sPathTarget in all places before copying it.

[Gabriel Ivăncescu (＠insn)]

This can crash if you parse, for example, "/" with the desktop IShellFolder.

[PATCH 1/1] shell32: Handle NULL sPathTarget in all places before copying it.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Currently it's only checked in some places.

Signed-off-by: Gabriel Ivăncescu 
---

This can crash if you parse, for example, "/" with the desktop IShellFolder.
---
 dlls/shell32/shfldr_fs.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/dlls/shell32/shfldr_fs.c b/dlls/shell32/shfldr_fs.c
index 662d8b52d5b..762444c6410 100644
--- a/dlls/shell32/shfldr_fs.c
+++ b/dlls/shell32/shfldr_fs.c
@@ -325,7 +325,9 @@ IShellFolder_fnParseDisplayName (IShellFolder2 * iface,
     if (*lpszDisplayName)
     {
         /* build the full pathname to the element */
-        lstrcpynW(szPath, This->sPathTarget, MAX_PATH - 1);
+        szPath[0] = '\0';
+        if (This->sPathTarget)
+            lstrcpynW(szPath, This->sPathTarget, MAX_PATH - 1);
         PathAddBackslashW(szPath);
         len = lstrlenW(szPath);
         /* get the next element */
@@ -939,12 +941,16 @@ static HRESULT WINAPI IShellFolder_fnSetNameOf (IShellFolder2 * iface,
     if (wcspbrk( lpName, L"\/:*?"<>|" )) return HRESULT_FROM_WIN32(ERROR_CANCELLED);

/* build source path */
-    lstrcpynW(szSrc, This->sPathTarget, MAX_PATH);
+    szSrc[0] = '\0';
+    if (This->sPathTarget)
+        lstrcpynW(szSrc, This->sPathTarget, MAX_PATH);
     ptr = PathAddBackslashW (szSrc);
     _ILSimpleGetTextW (pidl, ptr, MAX_PATH + 1 - (ptr - szSrc));

/* build destination path */
-    lstrcpynW(szDest, This->sPathTarget, MAX_PATH);
+    szDest[0] = '\0';
+    if (This->sPathTarget)
+        lstrcpynW(szDest, This->sPathTarget, MAX_PATH);
     ptr = PathAddBackslashW (szDest);
     lstrcpynW(ptr, lpName, MAX_PATH + 1 - (ptr - szDest));

[PATCH 0/1] MR1981: shell32: Handle NULL sPathTarget in all places before copying it. - closed

[Gabriel Ivăncescu (＠insn)]

This merge request was closed by Gabriel Ivăncescu.

[Gabriel Ivăncescu (＠insn)]

Superseded by !5225