From 04866685b1bf0912348f5f1712ba0d2cb4149f39 Mon Sep 17 00:00:00 2001
From: Martin Fuchs <fuchs.martin@gmail.com>
Date: Mon, 9 Feb 2004 22:33:05 +0000
Subject: [PATCH] fixed bounds checking in SHELL_GetPathFromIDListA/W()

svn path=/trunk/; revision=8119
---
 reactos/lib/shell32/pidl.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/reactos/lib/shell32/pidl.c b/reactos/lib/shell32/pidl.c
index 4168954c974..48ab6652c5c 100644
--- a/reactos/lib/shell32/pidl.c
+++ b/reactos/lib/shell32/pidl.c
@@ -1291,6 +1291,8 @@ HRESULT SHELL_GetPathFromIDListA(LPCITEMIDLIST pidl, LPSTR pszPath, UINT uOutSiz
 	LPSTR end = pszPath + uOutSize;
 	HRESULT hr = S_OK;
 
+	pszPath[0] = '\0';
+
 	/* One case is a PIDL rooted at desktop level */
 	if (_ILIsValue(pidl) || _ILIsFolder(pidl)) {
 	    hr = SHGetSpecialFolderPathA(0, pstr, CSIDL_DESKTOP, FALSE);
@@ -1313,6 +1315,10 @@ HRESULT SHELL_GetPathFromIDListA(LPCITEMIDLIST pidl, LPSTR pszPath, UINT uOutSiz
 		if (!txt)
 		    {hr = E_INVALIDARG; break;}
 
+                /* make sure there's enough space for the next segment */
+                if (pstr+lstrlenA(txt) >= end)
+		    {hr = E_INVALIDARG; break;}
+
 		lstrcpynA(pstr, txt, end-pstr);
 
 		pidl = ILGetNext(pidl);
@@ -1324,6 +1330,9 @@ HRESULT SHELL_GetPathFromIDListA(LPCITEMIDLIST pidl, LPSTR pszPath, UINT uOutSiz
 		    break;
 		}
 
+                if (pstr+1 >= end)
+		    {hr = E_INVALIDARG; break;}
+
 		pstr = PathAddBackslashA(pstr);
 		if (!pstr)
 		    {hr = E_INVALIDARG; break;}
@@ -1374,6 +1383,8 @@ HRESULT SHELL_GetPathFromIDListW(LPCITEMIDLIST pidl, LPWSTR pszPath, UINT uOutSi
 	LPWSTR end = pszPath + uOutSize;
 	HRESULT hr = S_OK;
 
+	pszPath[0] = '\0';
+
 	/* One case is a PIDL rooted at desktop level */
 	if (_ILIsValue(pidl) || _ILIsFolder(pidl)) {
 	    hr = SHGetSpecialFolderPathW(0, pstr, CSIDL_DESKTOP, FALSE);
@@ -1396,6 +1407,10 @@ HRESULT SHELL_GetPathFromIDListW(LPCITEMIDLIST pidl, LPWSTR pszPath, UINT uOutSi
 		if (!txt)
 		    {hr = E_INVALIDARG; break;}
 
+                /* make sure there's enough space for the next segment */
+                if (pstr+lstrlenA(txt) >= end)
+		    {hr = E_INVALIDARG; break;}
+
 		if (!MultiByteToWideChar(CP_ACP, 0, txt, -1, pstr, uOutSize))
 		    {hr = E_OUTOFMEMORY; break;}
 
@@ -1408,6 +1423,9 @@ HRESULT SHELL_GetPathFromIDListW(LPCITEMIDLIST pidl, LPWSTR pszPath, UINT uOutSi
 		    break;
 		}
 
+                if (pstr+1 >= end)
+		    {hr = E_INVALIDARG; break;}
+
 		pstr = PathAddBackslashW(pstr);
 		if (!pstr)
 		    {hr = E_INVALIDARG; break;}