From c7777f59637e3137f3e18d20fd0191e1b258bdf7 Mon Sep 17 00:00:00 2001
From: Whindmar Saksit <whindsaks@proton.me>
Date: Sun, 26 Nov 2023 13:41:02 +0100
Subject: [PATCH] [ZIPFLDR] Fix off-by-one count error during enumeration
 (#6040)

CORE-19342
---
 dll/shellext/zipfldr/CEnumZipContents.cpp | 33 ++++++++++++++++-------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/dll/shellext/zipfldr/CEnumZipContents.cpp b/dll/shellext/zipfldr/CEnumZipContents.cpp
index a3f5bcbf79c..4367c279f53 100644
--- a/dll/shellext/zipfldr/CEnumZipContents.cpp
+++ b/dll/shellext/zipfldr/CEnumZipContents.cpp
@@ -37,22 +37,35 @@ public:
         if (!rgelt || (!pceltFetched && celt != 1))
             return E_POINTER;
 
+        HRESULT hr = S_OK;
+        ULONG fetched = 0;
         LPITEMIDLIST item;
         CStringW name;
         bool dir;
         unz_file_info64 info;
-        for (ULONG i = 0; i < celt; ++i)
+
+        while (fetched < celt)
         {
-            if (pceltFetched)
-                *pceltFetched = i;
-            if (!mEnumerator.next_unique(m_Prefix, name, dir, info))
-                return S_FALSE;
-            item = _ILCreate(dir ? ZIP_PIDL_DIRECTORY : ZIP_PIDL_FILE, name, info);
-            if (!item)
-                return i ? S_FALSE : E_OUTOFMEMORY;
-            rgelt[i] = item;
+            if (mEnumerator.next_unique(m_Prefix, name, dir, info))
+            {
+                item = _ILCreate(dir ? ZIP_PIDL_DIRECTORY : ZIP_PIDL_FILE, name, info);
+                if (!item)
+                {
+                    hr = fetched ? S_FALSE : E_OUTOFMEMORY;
+                    break;
+                }
+                rgelt[fetched++] = item;
+            }
+            else
+            {
+                hr = S_FALSE;
+                break;
+            }
         }
-        return S_OK;
+
+        if (pceltFetched)
+            *pceltFetched = fetched;
+        return hr;
     }
     STDMETHODIMP Skip(ULONG celt)
     {