From 2f76e8ade22cebdb56d14c4f49cd7438ebbfa724 Mon Sep 17 00:00:00 2001
From: Johannes Anderwald <johannes.anderwald@reactos.org>
Date: Sun, 6 Jul 2008 20:52:11 +0000
Subject: [PATCH] - fix potential buffer overflows spotted by Christoph

svn path=/trunk/; revision=34344
---
 reactos/dll/win32/shell32/fprop.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/reactos/dll/win32/shell32/fprop.c b/reactos/dll/win32/shell32/fprop.c
index 5c0ac6bd038..de8bd88061e 100644
--- a/reactos/dll/win32/shell32/fprop.c
+++ b/reactos/dll/win32/shell32/fprop.c
@@ -678,13 +678,16 @@ EnumPropSheetExt(LPWSTR wFileName, HPROPSHEETPAGE * hppages, int NumPages, HPSXA
     pOffset = wcsrchr(wFileName, L'.');
     if (!pOffset)
     {
+        Length = wcslen(szName);
+        if (Length >=94)
+           return 0;
         wcscpy(szName, L"CLSID\\");
         wcscpy(&szName[6], wFileName);
     }
     else
     {
         Length = wcslen(pOffset);
-        if (Length  >= 70)
+        if (Length  >= 100)
             return 0;
         wcscpy(szName, pOffset);
     }
@@ -700,6 +703,7 @@ EnumPropSheetExt(LPWSTR wFileName, HPROPSHEETPAGE * hppages, int NumPages, HPSXA
         if (RegGetValueW(HKEY_CLASSES_ROOT, pOffset, NULL, RRF_RT_REG_SZ, NULL, szName, &dwName) == ERROR_SUCCESS)
         {
             TRACE("EnumPropSheetExt szName %s, pOffset %s\n", debugstr_w(szName), debugstr_w(pOffset));
+            szName[(sizeof(szName)/sizeof(WCHAR))-1] = L'\0';
             hpsxa[1] = SHCreatePropSheetExtArrayEx(HKEY_CLASSES_ROOT, szName, NumPages - Pages, pDataObj);
             Pages +=SHAddFromPropSheetExtArray(hpsxa[1], AddShellPropSheetExCallback, (LPARAM)hppages);
         }