Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-02-22 16:36:33 +00:00
Code Issues Projects Releases Packages Wiki Activity

[SHELL32] Prevent use after free

Browse source 
'buffer' is local to the function, while m_sPath is an instance class member.
Fix that by calling the IShellLink::Resolve() function, which will allocate
and fill the m_sPath variable.

CORE-15229
This commit is contained in:
Hervé Poussineau 2022-09-12 22:59:49 +02:00
parent f79e80c520
commit f3506ee626
1 changed files with 1 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
dll/win32/shell32/CShellLink.cpp
View file

@ -2735,12 +2735,9 @@ LPWSTR SH_GetTargetTypeByPath(LPCWSTR lpcwFullPath)
BOOL CShellLink::OnInitDialog(HWND hwndDlg, HWND hwndFocus, LPARAM lParam)
{
WCHAR buffer[MAX_PATH];
TRACE("CShellLink::OnInitDialog(hwnd %p hwndFocus %p lParam %p)\n", hwndDlg, hwndFocus, lParam);
if (m_pPidl && SHGetPathFromIDListW(m_pPidl, buffer))
m_sPath = buffer;
Resolve(0, SLR_NO_UI | SLR_NOUPDATE | SLR_NOSEARCH | SLR_NOTRACK);
TRACE("m_sArgs: %S sComponent: %S m_sDescription: %S m_sIcoPath: %S m_sPath: %S m_sPathRel: %S sProduct: %S m_sWorkDir: %S\n", m_sArgs, sComponent, m_sDescription,
m_sIcoPath, m_sPath, m_sPathRel, sProduct, m_sWorkDir);