security audit of explorer code...

strcpy -> lstrcpyn
strncpy -> lstrcpyn
[v]sprintf -> [v]snprintf
moved common Shell::get_path() subclass implementations into Shell::get_path_base() and made function overflow-proof
make other non-common subclass implementations of get_path overflow-proof

svn path=/trunk/; revision=17825

reactos/subsys/system/explorer/dialogs/searchprogram.cpp

@@ -150,7 +150,7 @@ void FindProgramDlg::Refresh(bool delete_cache)
 	_thread.Stop();
 
 	TCHAR buffer[1024];
-	GetWindowText(GetDlgItem(_hwnd, IDC_FILTER), buffer, 1024);
+	GetWindowText(GetDlgItem(_hwnd, IDC_FILTER), buffer, COUNTOF(buffer));
 #ifndef __WINE__ ///@todo _tcslwr() for Wine
 	_tcslwr(buffer);
 #endif
@@ -191,7 +191,7 @@ void FindProgramDlg::collect_programs_callback(Entry* entry, void* param)
 			if (SUCCEEDED(hr)) {
 				TCHAR entry_path[MAX_PATH];
 
-				entry->get_path(entry_path);
+				entry->get_path(entry_path, COUNTOF(entry_path));
 
 				String menu_path;
 
@@ -231,8 +231,8 @@ void FindProgramDlg::add_entry(const FPDEntry& cache_entry)
 	String lwr_name = cache_entry._entry->_display_name;
 
 #ifndef __WINE__ ///@todo _tcslwr() for Wine
-	_tcslwr((LPTSTR)lwr_path.c_str());
+	_tcslwr(&lwr_path.at(0));
-	_tcslwr((LPTSTR)lwr_name.c_str());
+	_tcslwr(&lwr_name.at(0));
 #endif
 
 	if (_lwr_filter.empty())

reactos/subsys/system/explorer/explorer.cpp

@@ -183,7 +183,7 @@ bool FileTypeManager::is_exe_file(LPCTSTR ext)
 const FileTypeInfo& FileTypeManager::operator[](String ext)
 {
 #ifndef __WINE__ ///@todo _tcslwr() for Wine
-	_tcslwr((LPTSTR)ext.c_str());
+	_tcslwr(&ext.at(0));
 #endif
 
 	iterator found = find(ext);
@@ -230,7 +230,7 @@ LPCTSTR FileTypeManager::set_type(Entry* entry, bool dont_hide_ext)
 		if (type._neverShowExt && !dont_hide_ext) {
 			int len = ext - entry->_data.cFileName;
 			entry->_display_name = (LPTSTR) malloc((len+1)*sizeof(TCHAR));
-			_tcsncpy(entry->_display_name, entry->_data.cFileName, len);
+			lstrcpyn(entry->_display_name, entry->_data.cFileName, len);
 			entry->_display_name[len] = TEXT('\0');
 		}
 
@@ -416,7 +416,7 @@ const Icon& IconCache::extract(LPCTSTR path, int idx)
 	CachePair key(path, idx);
 
 #ifndef __WINE__ ///@todo _tcslwr() for Wine
-	_tcslwr((LPTSTR)key.first.c_str());
+	_tcslwr(&key.first.at(0));
 #endif
 
 	PathIdxMap::iterator found = _pathIdxMap.find(key);

reactos/subsys/system/explorer/notifyhook/notifyhook.c

@@ -108,7 +108,7 @@ DECL_NOTIFYHOOK int GetWindowModulePathCopyData(LPARAM lparam, HWND* phwnd, LPST
 		struct COPYDATA_STRUCT* cds = (struct COPYDATA_STRUCT*) data->lpData;
 
 		*phwnd = cds->_hwnd;
-		strncpy(buffer, cds->_path, size);
+		lstrcpyn(buffer, cds->_path, size);
 
 		return cds->_len;
 	} else

reactos/subsys/system/explorer/shell/entries.cpp

@@ -325,7 +325,7 @@ void Entry::extract_icon()
 
 	ICON_ID icon_id = ICID_NONE;
 
-	if (get_path(path) && _tcsncmp(path,TEXT("::{"),3))
+	if (get_path(path, COUNTOF(path)) && _tcsncmp(path,TEXT("::{"),3))
 		icon_id = g_Globals._icon_cache.extract(path);
 
 	if (icon_id == ICID_NONE) {
@@ -392,7 +392,7 @@ BOOL Entry::launch_entry(HWND hwnd, UINT nCmdShow)
 {
 	TCHAR cmd[MAX_PATH];
 
-	if (!get_path(cmd))
+	if (!get_path(cmd, COUNTOF(cmd)))
 		return FALSE;
 
 	 // add path to the recent file list
@@ -453,7 +453,7 @@ HRESULT Entry::GetUIObjectOf(HWND hWnd, REFIID riid, LPVOID* ppvOut)
 {
 	TCHAR path[MAX_PATH];
 /*
-	if (!get_path(path))
+	if (!get_path(path, COUNTOF(path)))
 		return E_FAIL;
 
 	ShellPath shell_path(path);
@@ -479,7 +479,7 @@ HRESULT Entry::GetUIObjectOf(HWND hWnd, REFIID riid, LPVOID* ppvOut)
 	if (!_up)
 		return E_INVALIDARG;
 
-	if (!_up->get_path(path))
+	if (!_up->get_path(path, COUNTOF(path)))
 		return E_FAIL;
 
 	ShellPath shell_path(path);
@@ -505,6 +505,107 @@ HRESULT Entry::GetUIObjectOf(HWND hWnd, REFIID riid, LPVOID* ppvOut)
 	return hr;
 }
 
+ // get full path of specified directory entry
+bool Entry::get_path_base ( PTSTR path, size_t path_count, ENTRY_TYPE etype ) const
+{
+	int level = 0;
+	size_t len = 0;
+	size_t l = 0;
+	LPCTSTR name = NULL;
+	TCHAR buffer[MAX_PATH];
+
+	if ( !path || 0 == path_count )
+		return false;
+
+	const Entry* entry;
+	if ( path_count > 1 )
+	{
+		for(entry=this; entry; level++) {
+			l = 0;
+
+			if (entry->_etype == etype) {
+				name = entry->_data.cFileName;
+
+				for(LPCTSTR s=name; *s && *s!=TEXT('/') && *s!=TEXT('\\'); s++)
+					++l;
+
+				if (!entry->_up)
+					break;
+			} else {
+				if (entry->get_path(buffer, COUNTOF(buffer))) {
+					l = _tcslen(buffer);
+					name = buffer;
+
+					/* special handling of drive names */
+					if (l>0 && buffer[l-1]=='\\' && path[0]=='\\')
+						--l;
+
+					if ( len+l >= path_count )
+					{
+						if ( l + 1 > path_count )
+							len = 0;
+						else
+							len = path_count - l - 1;
+					}
+					memmove(path+l, path, len*sizeof(TCHAR));
+					if ( l+1 >= path_count )
+						l = path_count - 1;
+					memcpy(path, name, l*sizeof(TCHAR));
+					len += l;
+				}
+
+				entry = NULL;
+				break;
+			}
+
+			if (l > 0) {
+				if ( len+l+1 >= path_count )
+				{
+					/* compare to 2 here because of terminator plus the '\\' we prepend */
+					if ( l + 2 > path_count )
+						len = 0;
+					else
+						len = path_count - l - 2;
+				}
+				memmove(path+l+1, path, len*sizeof(TCHAR));
+				/* compare to 2 here because of terminator plus the '\\' we prepend */
+				if ( l+2 >= path_count )
+					l = path_count - 2;
+				memcpy(path+1, name, l*sizeof(TCHAR));
+				len += l+1;
+
+				if ( etype == ET_WINDOWS && entry->_up && !(entry->_up->_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY))	// a NTFS stream?
+					path[0] = TEXT(':');
+				else
+					path[0] = TEXT('\\');
+			}
+
+			entry = entry->_up;
+		}
+
+		if (entry) {
+			if ( len+l >= path_count )
+			{
+				if ( l + 1 > path_count )
+					len = 0;
+				else
+					len = path_count - l - 1;
+			}
+			memmove(path+l, path, len*sizeof(TCHAR));
+			if ( l+1 >= path_count )
+				l = path_count - 1;
+			memcpy(path, name, l*sizeof(TCHAR));
+			len += l;
+		}
+
+		if ( !level && (len+1 < path_count) )
+			path[len++] = TEXT('\\');
+	}
+
+	path[len] = TEXT('\0');
+
+	return true;
+}
 
  // recursively free all child entries
 void Entry::free_subentries()

reactos/subsys/system/explorer/shell/entries.h

@@ -108,11 +108,14 @@ public:
 	virtual void		read_directory(int scan_flags=SCAN_ALL) {}
 	virtual const void*	get_next_path_component(const void*) const {return NULL;}
 	virtual Entry*		find_entry(const void*) {return NULL;}
-	virtual bool		get_path(PTSTR path) const = 0;
+	virtual bool		get_path(PTSTR path, size_t path_count) const = 0;
 	virtual ShellPath	create_absolute_pidl() const {return (LPCITEMIDLIST)NULL;}
 	virtual HRESULT		GetUIObjectOf(HWND hWnd, REFIID riid, LPVOID* ppvOut);
 	virtual BOOL		launch_entry(HWND hwnd, UINT nCmdShow=SW_SHOWNORMAL);
 	virtual HRESULT		do_context_menu(HWND hwnd, const POINT& pos, CtxMenuInterfaces& cm_ifs);
+
+protected:
+	bool get_path_base(PTSTR path, size_t path_count, ENTRY_TYPE etype) const;
 };
 
 

reactos/subsys/system/explorer/shell/fatfs.cpp

@@ -244,67 +244,9 @@ Entry* FATDirectory::find_entry(const void* p)
 
 
  // get full path of specified directory entry
-bool FATEntry::get_path(PTSTR path) const
+bool FATEntry::get_path(PTSTR path, size_t path_count) const
 {
-	int level = 0;
+	return get_path_base ( path, path_count, ET_FAT );
-	int len = 0;
-	int l = 0;
-	LPCTSTR name = NULL;
-	TCHAR buffer[MAX_PATH];
-
-	const Entry* entry;
-	for(entry=this; entry; level++) {
-		l = 0;
-
-		if (entry->_etype == ET_FAT) {
-			name = entry->_data.cFileName;
-
-			for(LPCTSTR s=name; *s && *s!=TEXT('/') && *s!=TEXT('\\'); s++)
-				++l;
-
-			if (!entry->_up)
-				break;
-		} else {
-			if (entry->get_path(buffer)) {
-				l = _tcslen(buffer);
-				name = buffer;
-
-				/* special handling of drive names */
-				if (l>0 && buffer[l-1]=='\\' && path[0]=='\\')
-					--l;
-
-				memmove(path+l, path, len*sizeof(TCHAR));
-				memcpy(path, name, l*sizeof(TCHAR));
-				len += l;
-			}
-
-			entry = NULL;
-			break;
-		}
-
-		if (l > 0) {
-			memmove(path+l+1, path, len*sizeof(TCHAR));
-			memcpy(path+1, name, l*sizeof(TCHAR));
-			len += l+1;
-
-			path[0] = TEXT('\\');
-		}
-
-		entry = entry->_up;
-	}
-
-	if (entry) {
-		memmove(path+l, path, len*sizeof(TCHAR));
-		memcpy(path, name, l*sizeof(TCHAR));
-		len += l;
-	}
-
-	if (!level)
-		path[len++] = TEXT('\\');
-
-	path[len] = TEXT('\0');
-
-	return true;
 }
 
 ShellPath FATEntry::create_absolute_pidl() const
@@ -315,7 +257,7 @@ ShellPath FATEntry::create_absolute_pidl() const
 /* prepend root path if the drive is currently actually mounted in the file system -> return working PIDL
 	TCHAR path[MAX_PATH];
 
-	if (get_path(path))
+	if (get_path(path, COUNTOF(path)))
 		return ShellPath(path);
 
 	return ShellPath();

reactos/subsys/system/explorer/shell/fatfs.h

@@ -34,7 +34,7 @@ struct FATEntry : public Entry
 protected:
 	FATEntry() : Entry(ET_FAT) {}
 
-	virtual bool get_path(PTSTR path) const;
+	virtual bool get_path(PTSTR path, size_t path_count) const;
 	virtual ShellPath create_absolute_pidl() const;
 
 	DWORD	_cluster;

reactos/subsys/system/explorer/shell/filechild.cpp

@@ -280,7 +280,7 @@ void FileChildWindow::set_curdir(Entry* entry)
 			_right->set_header();
 		}
 
-		entry->get_path(_path);
+		entry->get_path(_path, COUNTOF(_path));
 	}
 
 	if (_hwnd)	// only change window title if the window already exists
@@ -453,7 +453,7 @@ LRESULT FileChildWindow::WndProc(UINT nmsg, WPARAM wparam, LPARAM lparam)
 			TCHAR path[MAX_PATH];
 
 			if (_left && _left->_cur) {
-				_left->_cur->get_path(path);
+				_left->_cur->get_path(path, COUNTOF(path));
 				SetCurrentDirectory(path);
 			}
 

reactos/subsys/system/explorer/shell/mainframe.cpp

@@ -1608,7 +1608,7 @@ void SDIMainFrame::entry_selected(Entry* entry)
 
 		TCHAR path[MAX_PATH];
 
-		if (shell_entry->get_path(path)) {
+		if (shell_entry->get_path(path,COUNTOF(path))) {
 			String url;
 
 			if (path[0] == ':')

reactos/subsys/system/explorer/shell/ntobjfs.cpp

@@ -237,12 +237,12 @@ void NtObjDirectory::read_directory(int scan_flags)
 			} else {
 				info->type.string_ptr = TEXT("");
 			}
-			wcscpyn(p, info->name.string_ptr, _MAX_PATH);
+			lstrcpynW(p, info->name.string_ptr, _MAX_PATH);
 #else
 			WideCharToMultiByte(CP_ACP, 0, info->name.string_ptr, info->name.string_len, p, MAX_PATH, 0, 0);
 #endif
 
-			lstrcpy(w32fd.cFileName, p);
+			lstrcpyn(w32fd.cFileName, p, sizeof(w32fd.cFileName) / sizeof(0[w32fd.cFileName]));
 
 			const LPCWSTR* tname = NTDLL::s_ObjectTypes;
 			OBJECT_TYPE type = UNKNOWN_OBJECT_TYPE;
@@ -379,67 +379,9 @@ Entry* NtObjDirectory::find_entry(const void* p)
 
 
  // get full path of specified directory entry
-bool NtObjEntry::get_path(PTSTR path) const
+bool NtObjEntry::get_path(PTSTR path, size_t path_count) const
 {
-	int level = 0;
+	return get_path_base ( path, path_count, ET_NTOBJS );
-	int len = 0;
-	int l = 0;
-	LPCTSTR name = NULL;
-	TCHAR buffer[MAX_PATH];
-
-	const Entry* entry;
-	for(entry=this; entry; level++) {
-		l = 0;
-
-		if (entry->_etype == ET_NTOBJS) {
-			name = entry->_data.cFileName;
-
-			for(LPCTSTR s=name; *s && *s!=TEXT('/') && *s!=TEXT('\\'); s++)
-				++l;
-
-			if (!entry->_up)
-				break;
-		} else {
-			if (entry->get_path(buffer)) {
-				l = _tcslen(buffer);
-				name = buffer;
-
-				/* special handling of drive names */
-				if (l>0 && buffer[l-1]=='\\' && path[0]=='\\')
-					--l;
-
-				memmove(path+l, path, len*sizeof(TCHAR));
-				memcpy(path, name, l*sizeof(TCHAR));
-				len += l;
-			}
-
-			entry = NULL;
-			break;
-		}
-
-		if (l > 0) {
-			memmove(path+l+1, path, len*sizeof(TCHAR));
-			memcpy(path+1, name, l*sizeof(TCHAR));
-			len += l+1;
-
-			path[0] = TEXT('\\');
-		}
-
-		entry = entry->_up;
-	}
-
-	if (entry) {
-		memmove(path+l, path, len*sizeof(TCHAR));
-		memcpy(path, name, l*sizeof(TCHAR));
-		len += l;
-	}
-
-	if (!level)
-		path[len++] = TEXT('\\');
-
-	path[len] = TEXT('\0');
-
-	return true;
 }
 
 BOOL NtObjEntry::launch_entry(HWND hwnd, UINT nCmdShow)

reactos/subsys/system/explorer/shell/ntobjfs.h

@@ -91,7 +91,7 @@ struct NtObjEntry : public Entry
 protected:
 	NtObjEntry(OBJECT_TYPE type) : Entry(ET_NTOBJS), _type(type) {}
 
-	virtual bool get_path(PTSTR path) const;
+	virtual bool get_path(PTSTR path, size_t path_count) const;
 	virtual BOOL launch_entry(HWND hwnd, UINT nCmdShow);
 };
 

reactos/subsys/system/explorer/shell/regfs.cpp

@@ -223,67 +223,9 @@ Entry* RegDirectory::find_entry(const void* p)
 
 
  // get full path of specified registry entry
-bool RegEntry::get_path(PTSTR path) const
+bool RegEntry::get_path(PTSTR path, size_t path_count) const
 {
-	int level = 0;
+	return get_path_base ( path, path_count, ET_REGISTRY );
-	int len = 0;
-	int l = 0;
-	LPCTSTR name = NULL;
-	TCHAR buffer[MAX_PATH];
-
-	const Entry* entry;
-	for(entry=this; entry; level++) {
-		l = 0;
-
-		if (entry->_etype == ET_REGISTRY) {
-			name = entry->_data.cFileName;
-
-			for(LPCTSTR s=name; *s && *s!=TEXT('/') && *s!=TEXT('\\'); s++)
-				++l;
-
-			if (!entry->_up)
-				break;
-		} else {
-			if (entry->get_path(buffer)) {
-				l = _tcslen(buffer);
-				name = buffer;
-
-				/* special handling of drive names */
-				if (l>0 && buffer[l-1]=='\\' && path[0]=='\\')
-					--l;
-
-				memmove(path+l, path, len*sizeof(TCHAR));
-				memcpy(path, name, l*sizeof(TCHAR));
-				len += l;
-			}
-
-			entry = NULL;
-			break;
-		}
-
-		if (l > 0) {
-			memmove(path+l+1, path, len*sizeof(TCHAR));
-			memcpy(path+1, name, l*sizeof(TCHAR));
-			len += l+1;
-
-			path[0] = TEXT('\\');
-		}
-
-		entry = entry->_up;
-	}
-
-	if (entry) {
-		memmove(path+l, path, len*sizeof(TCHAR));
-		memcpy(path, name, l*sizeof(TCHAR));
-		len += l;
-	}
-
-	if (!level)
-		path[len++] = TEXT('\\');
-
-	path[len] = TEXT('\0');
-
-	return true;
 }
 
 BOOL RegEntry::launch_entry(HWND hwnd, UINT nCmdShow)

reactos/subsys/system/explorer/shell/regfs.h

@@ -34,7 +34,7 @@ struct RegEntry : public Entry
 protected:
 	RegEntry() : Entry(ET_REGISTRY) {}
 
-	virtual bool get_path(PTSTR path) const;
+	virtual bool get_path(PTSTR path, size_t path_count) const;
 	virtual BOOL launch_entry(HWND hwnd, UINT nCmdShow);
 };
 

reactos/subsys/system/explorer/shell/shellbrowser.cpp

@@ -626,7 +626,7 @@ void MDIShellBrowserChild::entry_selected(Entry* entry)
 
 		TCHAR path[MAX_PATH];
 
-		if (shell_entry->get_path(path)) {
+		if (shell_entry->get_path(path, COUNTOF(path))) {
 			String url;
 
 			if (path[0] == ':')

reactos/subsys/system/explorer/shell/shellfs.cpp

@@ -126,8 +126,10 @@ ShellPath ShellEntry::create_absolute_pidl() const
 
 
  // get full path of a shell entry
-bool ShellEntry::get_path(PTSTR path) const
+bool ShellEntry::get_path(PTSTR path, size_t path_count) const
 {
+	if ( !path || 0 == path_count )
+		return false;
 /*
 	path[0] = TEXT('\0');
 
@@ -138,7 +140,7 @@ bool ShellEntry::get_path(PTSTR path) const
 	LPCTSTR ret = fs_path;
 
 	if (ret) {
-		_tcscpy(path, ret);
+		lstrcpyn(path, ret, path_count);
 		return true;
 	} else
 		return false;
@@ -146,10 +148,13 @@ bool ShellEntry::get_path(PTSTR path) const
 
 
  // get full path of a shell folder
-bool ShellDirectory::get_path(PTSTR path) const
+bool ShellDirectory::get_path(PTSTR path, size_t path_count) const
 {
 	CONTEXT("ShellDirectory::get_path()");
 
+	if ( !path || 0 == path_count )
+		return false;
+
 	path[0] = TEXT('\0');
 
 	if (_folder.empty())
@@ -163,7 +168,7 @@ bool ShellDirectory::get_path(PTSTR path) const
 	if (!(attribs & SFGAO_FILESYSTEM))
 		return false;
 
-	if (FAILED(path_from_pidl(get_parent_folder(), &*_pidl, path, MAX_PATH)))
+	if (FAILED(path_from_pidl(get_parent_folder(), &*_pidl, path, path_count)))
 		return false;
 
 	return true;
@@ -235,11 +240,12 @@ void ShellDirectory::read_directory(int scan_flags)
 
 	TCHAR buffer[MAX_PATH];
 
-	if ((scan_flags&SCAN_FILESYSTEM) && get_path(buffer) && _tcsncmp(buffer,TEXT("::{"),3)) {
+	if ((scan_flags&SCAN_FILESYSTEM) && get_path(buffer, COUNTOF(buffer)) && _tcsncmp(buffer,TEXT("::{"),3)) {
 		Entry* entry = NULL;	// eliminate useless GCC warning by initializing entry
 
 		LPTSTR p = buffer + _tcslen(buffer);
 
+		// TODO FIXME - this can overflow
 		lstrcpy(p, TEXT("\\*"));
 
 		WIN32_FIND_DATA w32fd;

reactos/subsys/system/explorer/shell/shellfs.h

@@ -32,7 +32,7 @@ struct ShellEntry : public Entry
 	ShellEntry(Entry* parent, LPITEMIDLIST shell_path) : Entry(parent, ET_SHELL), _pidl(shell_path) {}
 	ShellEntry(Entry* parent, const ShellPath& shell_path) : Entry(parent, ET_SHELL), _pidl(shell_path) {}
 
-	virtual bool		get_path(PTSTR path) const;
+	virtual bool		get_path(PTSTR path, size_t path_count) const;
 	virtual ShellPath	create_absolute_pidl() const;
 	virtual HRESULT		GetUIObjectOf(HWND hWnd, REFIID riid, LPVOID* ppvOut);
 	virtual BOOL		launch_entry(HWND hwnd, UINT nCmdShow=SW_SHOWNORMAL);
@@ -103,7 +103,7 @@ struct ShellDirectory : public ShellEntry, public Directory
 	virtual const void* get_next_path_component(const void*) const;
 	virtual Entry* find_entry(const void*);
 
-	virtual bool get_path(PTSTR path) const;
+	virtual bool get_path(PTSTR path, size_t path_count) const;
 
 	int	extract_icons();
 

reactos/subsys/system/explorer/shell/unixfs.cpp

@@ -156,40 +156,68 @@ Entry* UnixDirectory::find_entry(const void* p)
 
 
  // get full path of specified directory entry
-void UnixEntry::get_path(PTSTR path) const
+bool UnixEntry::get_path(PTSTR path, size_t path_count) const
 {
 	int level = 0;
-	int len = 0;
+	size_t len = 0;
 
-	for(const Entry* entry=this; entry; level++) {
+	if ( !path || 0 == path_count )
-		LPCTSTR name = entry->_data.cFileName;
+		return false;
-		int l = 0;
 
-		for(LPCTSTR s=name; *s && *s!=TEXT('/'); s++)
+	if ( path_count > 1 )
-			++l;
+	{
+		for(const Entry* entry=this; entry; level++) {
+			LPCTSTR name = entry->_data.cFileName;
+			size_t l = 0;
 
-		if (entry->_up) {
+			for(LPCTSTR s=name; *s && *s!=TEXT('/'); s++)
-			if (l > 0) {
+				++l;
-				memmove(path+l+1, path, len*sizeof(TCHAR));
-				memcpy(path+1, name, l*sizeof(TCHAR));
-				len += l+1;
 
-				path[0] = TEXT('/');
+			if (entry->_up) {
+				if (l > 0) {
+					if ( len+l+1 >= path_count )
+					{
+						/* compare to 2 here because of terminator plus the '\\' we prepend */
+						if ( l + 2 > path_count )
+							len = 0;
+						else
+							len = path_count - l - 2;
+					}
+					memmove(path+l+1, path, len*sizeof(TCHAR));
+					/* compare to 2 here because of terminator plus the '\\' we prepend */
+					if ( l+2 >= path_count )
+						l = path_count - 2;
+					memcpy(path+1, name, l*sizeof(TCHAR));
+					len += l+1;
+
+					path[0] = TEXT('/');
+				}
+
+				entry = entry->_up;
+			} else {
+				if ( len+l >= path_count )
+				{
+					if ( l + 1 > path_count )
+						len = 0;
+					else
+						len = path_count - l - 1;
+				}
+				memmove(path+l, path, len*sizeof(TCHAR));
+				if ( l+1 >= path_count )
+					l = path_count - 1;
+				memcpy(path, name, l*sizeof(TCHAR));
+				len += l;
+				break;
 			}
-
-			entry = entry->_up;
-		} else {
-			memmove(path+l, path, len*sizeof(TCHAR));
-			memcpy(path, name, l*sizeof(TCHAR));
-			len += l;
-			break;
 		}
+
+		if ( !level && (len+1 < path_count) )
+			path[len++] = TEXT('/');
 	}
 
-	if (!level)
-		path[len++] = TEXT('/');
-
 	path[len] = TEXT('\0');
+
+	return true;
 }
 
 #endif // __WINE__

reactos/subsys/system/explorer/shell/unixfs.h

@@ -35,7 +35,7 @@ struct UnixEntry : public Entry
 protected:
 	UnixEntry() : Entry(ET_UNIX) {}
 
-	virtual void get_path(PTSTR path) const;
+	virtual bool get_path(PTSTR path, size_t path_count) const;
 };
 
 struct UnixDirectory : public UnixEntry, public Directory

reactos/subsys/system/explorer/shell/winfs.cpp

@@ -229,70 +229,9 @@ Entry* WinDirectory::find_entry(const void* p)
 
 
  // get full path of specified directory entry
-bool WinEntry::get_path(PTSTR path) const
+bool WinEntry::get_path(PTSTR path, size_t path_count) const
 {
-	int level = 0;
+	return get_path_base ( path, path_count, ET_WINDOWS );
-	int len = 0;
-	int l = 0;
-	LPCTSTR name = NULL;
-	TCHAR buffer[MAX_PATH];
-
-	const Entry* entry;
-	for(entry=this; entry; level++) {
-		l = 0;
-
-		if (entry->_etype == ET_WINDOWS) {
-			name = entry->_data.cFileName;
-
-			for(LPCTSTR s=name; *s && *s!=TEXT('/') && *s!=TEXT('\\'); s++)
-				++l;
-
-			if (!entry->_up)
-				break;
-		} else {
-			if (entry->get_path(buffer)) {
-				l = _tcslen(buffer);
-				name = buffer;
-
-				/* special handling of drive names */
-				if (l>0 && buffer[l-1]=='\\' && path[0]=='\\')
-					--l;
-
-				memmove(path+l, path, len*sizeof(TCHAR));
-				memcpy(path, name, l*sizeof(TCHAR));
-				len += l;
-			}
-
-			entry = NULL;
-			break;
-		}
-
-		if (l > 0) {
-			memmove(path+l+1, path, len*sizeof(TCHAR));
-			memcpy(path+1, name, l*sizeof(TCHAR));
-			len += l+1;
-
-			if (entry->_up && !(entry->_up->_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY))	// a NTFS stream?
-				path[0] = TEXT(':');
-			else
-				path[0] = TEXT('\\');
-		}
-
-		entry = entry->_up;
-	}
-
-	if (entry) {
-		memmove(path+l, path, len*sizeof(TCHAR));
-		memcpy(path, name, l*sizeof(TCHAR));
-		len += l;
-	}
-
-	if (!level)
-		path[len++] = TEXT('\\');
-
-	path[len] = TEXT('\0');
-
-	return true;
 }
 
 ShellPath WinEntry::create_absolute_pidl() const
@@ -301,7 +240,7 @@ ShellPath WinEntry::create_absolute_pidl() const
 
 	TCHAR path[MAX_PATH];
 
-	if (get_path(path))
+	if (get_path(path, COUNTOF(path)))
 		return ShellPath(path);
 
 	return ShellPath();

reactos/subsys/system/explorer/shell/winfs.h

@@ -34,7 +34,7 @@ struct WinEntry : public Entry
 protected:
 	WinEntry() : Entry(ET_WINDOWS) {}
 
-	virtual bool get_path(PTSTR path) const;
+	virtual bool get_path(PTSTR path, size_t path_count) const;
 	virtual ShellPath create_absolute_pidl() const;
 };
 

reactos/subsys/system/explorer/taskbar/favorites.cpp

@@ -395,7 +395,7 @@ void BookmarkList::import_IE_favorites(ShellDirectory& dir, HWND hwnd)
 				ShellDirectory new_dir(dir._folder, static_cast<ShellEntry*>(entry)->_pidl, hwnd);
 				new_folder._bookmarks.import_IE_favorites(new_dir, hwnd);
 			} else {
-				entry->get_path(path);
+				entry->get_path(path, COUNTOF(path));
 				ShellDirectory new_dir(GetDesktopFolder(), path, hwnd);
 				new_folder._bookmarks.import_IE_favorites(new_dir, hwnd);
 			}
@@ -406,7 +406,7 @@ void BookmarkList::import_IE_favorites(ShellDirectory& dir, HWND hwnd)
 
 			bookmark._name = DecodeXMLString(name);
 
-			entry->get_path(path);
+			entry->get_path(path, COUNTOF(path));
 			_tsplitpath(path, NULL, NULL, NULL, ext);
 
 			if (!_tcsicmp(ext, TEXT(".url"))) {

reactos/subsys/system/explorer/taskbar/startmenu.cpp

@@ -249,7 +249,7 @@ void StartMenu::AddShellEntries(const ShellDirectory& dir, int max, const String
 		_tcscat(ignore_path, ignore_dir);
 		_tcscat(ignore_name, ignore_ext);
 
-		dir.get_path(dir_path);
+		dir.get_path(dir_path, COUNTOF(dir_path));
 
 		if (_tcsicmp(trim_path_slash(dir_path), trim_path_slash(ignore_path)))
 			*ignore_name = '\0';
@@ -1286,7 +1286,7 @@ void StartMenu::ActivateEntry(int id, const ShellEntrySet& entries)
 			else {
 				TCHAR path[MAX_PATH];
 
-				if (entry->get_path(path))
+				if (entry->get_path(path, COUNTOF(path)))
 					new_folders.push_back(path);
 			}
 

reactos/subsys/system/explorer/utility/shellclasses.cpp

@@ -44,7 +44,7 @@ const LPCTSTR sCFSTR_SHELLIDLIST = TEXT("Shell IDList Array");
 
  // helper functions for string copying
 
-LPSTR strcpyn(LPSTR dest, LPCSTR source, size_t count)
+/*LPSTR strcpyn(LPSTR dest, LPCSTR source, size_t count)
 {
 	LPCSTR s;
 	LPSTR d = dest;
@@ -64,7 +64,7 @@ LPWSTR wcscpyn(LPWSTR dest, LPCWSTR source, size_t count)
 		count--;
 
 	return dest;
-}
+}*/
 
 
 String COMException::toString() const

reactos/subsys/system/explorer/utility/shellclasses.h

@@ -85,7 +85,7 @@ struct COMExceptionBase
 				LocalFree(pBuf);
 			 } else {
 				TCHAR buffer[128];
-				_stprintf(buffer, TEXT("unknown Exception: 0x%08lX"), _hr);
+				_sntprintf(buffer, COUNTOF(buffer), TEXT("unknown Exception: 0x%08lX"), _hr);
 				_msg = buffer;
 			 }
 		}
@@ -769,14 +769,14 @@ struct ShellPath : public SShellPtr<ITEMIDLIST>
 
 #ifdef UNICODE
 #define	StrRet StrRetW
-#define	tcscpyn wcscpyn
+//#define	tcscpyn wcscpyn
 #else
 #define	StrRet StrRetA
-#define	tcscpyn strcpyn
+//#define	tcscpyn strcpyn
 #endif
 
-extern LPSTR strcpyn(LPSTR dest, LPCSTR source, size_t count);
+//extern LPSTR strcpyn(LPSTR dest, LPCSTR source, size_t count);
-extern LPWSTR wcscpyn(LPWSTR dest, LPCWSTR source, size_t count);
+//extern LPWSTR wcscpyn(LPWSTR dest, LPCWSTR source, size_t count);
 
  /// easy retrieval of multi byte strings out of STRRET structures
 struct StrRetA : public STRRET
@@ -795,11 +795,11 @@ struct StrRetA : public STRRET
 			break;
 
 		  case STRRET_OFFSET:
-			strcpyn(b, (LPCSTR)&shiid+UNION_MEMBER(uOffset), l);
+			lstrcpynA(b, (LPCSTR)&shiid+UNION_MEMBER(uOffset), l);
 			break;
 
 		  case STRRET_CSTR:
-			strcpyn(b, UNION_MEMBER(cStr), l);
+			lstrcpynA(b, UNION_MEMBER(cStr), l);
 		}
 	}
 };
@@ -817,7 +817,7 @@ struct StrRetW : public STRRET
 	{
 		switch(uType) {
 		  case STRRET_WSTR:
-			wcscpyn(b, UNION_MEMBER(pOleStr), l);
+			lstrcpynW(b, UNION_MEMBER(pOleStr), l);
 			break;
 
 		  case STRRET_OFFSET:

reactos/subsys/system/explorer/utility/utility.h

@@ -804,7 +804,7 @@ struct String
 		TCHAR b[BUFFER_LEN];
 
 		va_start(l, fmt);
-		super::assign(b, _vstprintf(b, fmt, l));
+		super::assign(b, _vsntprintf(b, COUNTOF(b), fmt, l));
 		va_end(l);
 
 		return *this;
@@ -814,7 +814,7 @@ struct String
 	{
 		TCHAR b[BUFFER_LEN];
 
-		super::assign(b, _vstprintf(b, fmt, l));
+		super::assign(b, _vsntprintf(b, COUNTOF(b), fmt, l));
 
 		return *this;
 	}
@@ -825,7 +825,7 @@ struct String
 		TCHAR b[BUFFER_LEN];
 
 		va_start(l, fmt);
-		super::append(b, _vstprintf(b, fmt, l));
+		super::append(b, _vsntprintf(b, COUNTOF(b), fmt, l));
 		va_end(l);
 
 		return *this;
@@ -835,7 +835,7 @@ struct String
 	{
 		TCHAR b[BUFFER_LEN];
 
-		super::append(b, _vstprintf(b, fmt, l));
+		super::append(b, _vsntprintf(b, COUNTOF(b), fmt, l));
 
 		return *this;
 	}
@@ -894,7 +894,7 @@ struct UNC
 		int l = strlen(s) + 1;
 		_str = (LPWSTR) malloc(2*l);
 
-		if (MultiByteToWideChar(CP_ACP, 0, s, -1, _str, l) <= 0)
+		if (_str && MultiByteToWideChar(CP_ACP, 0, s, -1, _str, l) <= 0)
 			*_str = '\0';
 	}
 

reactos/subsys/system/explorer/utility/xmlstorage.h

@@ -82,8 +82,8 @@ namespace XMLStorage {
 #define	XS_nicmp strnicmp
 #define	XS_toi atoi
 #define	XS_len strlen
-#define	XS_sprintf sprintf
+#define	XS_snprintf snprintf
-#define	XS_vsprintf vsprintf
+#define	XS_vsnprintf vsnprintf
 #else
 #define	XS_CHAR TCHAR
 #define	XS_TEXT(x) TEXT(x)
@@ -93,8 +93,8 @@ namespace XMLStorage {
 #define	XS_nicmp _tcsnicmp
 #define	XS_toi _ttoi
 #define	XS_len _tcslen
-#define	XS_sprintf _stprintf
+#define	XS_snprintf _sntprintf
-#define	XS_vsprintf _vstprintf
+#define	XS_vsnprintf _vsntprintf
 #endif
 
 #if defined(_STRING_DEFINED) && !defined(XS_STRING_UTF8)
@@ -1351,7 +1351,7 @@ struct XMLInt
 	operator XS_String() const
 	{
 		XS_CHAR buffer[32];
-		XS_sprintf(buffer, XS_NUMBERFMT, _value);
+		XS_snprintf(buffer, COUNTOF(buffer), XS_NUMBERFMT, _value);
 		return buffer;
 	}
 
@@ -1386,7 +1386,7 @@ struct XMLIntRef
 	void assign(int value)
 	{
 		XS_CHAR buffer[32];
-		XS_sprintf(buffer, XS_NUMBERFMT, value);
+		XS_snprintf(buffer, COUNTOF(buffer), XS_NUMBERFMT, value);
 		_ref.assign(buffer);
 	}