[Tcl-bugs] [ tktoolkit-Bugs-3116922 ] memory error in tk_get*File on Windows

[SourceForge.net <no...@so...>]

Bugs item #3116922, was opened at 2010-11-23 13:12
Message generated for change (Tracker Item Submitted) made by treectrl
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112997&aid=3116922&group_id=12997

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 37. [tk_get*File]
Group: current: 8.5.9
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Tim Baker (treectrl)
Assigned to: Jeffrey Hobbs (hobbs)
Summary: memory error in tk_get*File on Windows

Initial Comment:
In tkWinDialog.c, OFNHookProcW, when browsing in the "Recent Places" directory, this call:

    dirsize = SendMessageW(hdlg, CDM_GETFOLDERPATH, 0, 0);

results in dirsize == -1.  Then:

    buffer += dirsize
    SendMessageW(hdlg, CDM_GETSPEC, selsize, (int) buffer);

writes before the start of the buffer. Then:

    buffer[selsize] = '\0';	/* Second NULL terminator. */
    buffer--;
    *buffer = '\\';

again writes before the start, all causing ckrealloc() to later fail
due to the ofnData->dynFileBuffer getting messed up.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112997&aid=3116922&group_id=12997