7012520: Heap overflow vulnerability in FileDialog.show()
Reviewed-by: art, anthony
--- a/jdk/src/windows/native/sun/windows/awt_FileDialog.cpp Fri Feb 18 13:31:57 2011 +0000
+++ b/jdk/src/windows/native/sun/windows/awt_FileDialog.cpp Fri Feb 25 15:54:54 2011 +0300
@@ -285,7 +285,7 @@
file = (jstring)env->GetObjectField(target, AwtFileDialog::fileID);
if (file != NULL) {
LPCTSTR tmp = JNU_GetStringPlatformChars(env, file, NULL);
- _tcscpy(fileBuffer, tmp);
+ _tcsncpy(fileBuffer, tmp, bufferLimit - 2); // the fileBuffer is double null terminated string
JNU_ReleaseStringPlatformChars(env, file, tmp);
} else {
fileBuffer[0] = _T('\0');