Check for buffer being big enough in wxPathOnly().

Just return NULL or empty string if the input path is too long. This is
probably not ideal but it fixes a buffer overflow and all this code needs to
be rewritten to use wxFileName() anyhow so it's not worth doing anything more
at this moment.

Closes #15302.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@74455 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/src/common/filefn.cpp b/src/common/filefn.cpp
index cb035c4407febe962cf67aa95cecfc61351ef3a5..061ea5f7c3dbf73125c678dd26c57809fe9567d7 100644 (file)
--- a/src/common/filefn.cpp
+++ b/src/common/filefn.cpp
@@ -743,11 +743,13 @@ wxPathOnly (wxChar *path)
     {
         static wxChar buf[_MAXPATHLEN];
 
     {
         static wxChar buf[_MAXPATHLEN];
 

-        // Local copy
-        wxStrcpy (buf, path);
-

         int l = wxStrlen(path);
         int i = l - 1;
         int l = wxStrlen(path);
         int i = l - 1;

+        if ( i >= _MAXPATHLEN )
+            return NULL;
+
+        // Local copy
+        wxStrcpy (buf, path);

 
         // Search backward for a backward or forward slash
         while (i > -1)
 
         // Search backward for a backward or forward slash
         while (i > -1)


@@ -789,12 +791,15 @@ wxString wxPathOnly (const wxString& path)
     {
         wxChar buf[_MAXPATHLEN];
 
     {
         wxChar buf[_MAXPATHLEN];
 

-        // Local copy
-        wxStrcpy(buf, path);
-

         int l = path.length();
         int i = l - 1;
 
         int l = path.length();
         int i = l - 1;
 

+        if ( i >= _MAXPATHLEN )
+            return wxString();
+
+        // Local copy
+        wxStrcpy(buf, path);
+

         // Search backward for a backward or forward slash
         while (i > -1)
         {
         // Search backward for a backward or forward slash
         while (i > -1)
         {