[DEVMGR] Fix buffer overflow & TCHAR misuse

ThFabba · Oct 12, 2023 · e9a8a4b · e9a8a4b
1 parent 70d5c86
commit e9a8a4b
Showing 1 changed file with 17 additions and 13 deletions.
diff --git a/dll/win32/devmgr/properties/advprop.cpp b/dll/win32/devmgr/properties/advprop.cpp
@@ -408,12 +408,15 @@ DriverDetailsDlgProc(IN HWND hwndDlg,
                         {
                             /* extract version info and update the labels */
                             WCHAR szDriverPath[MAX_PATH];
+                            LV_ITEMW lvi = { 0 };
 
-                            ListView_GetItemText(hDriversListView,
-                                                 pnmv->iItem,
-                                                 pnmv->iSubItem,
-                                                 szDriverPath,
-                                                 MAX_PATH);
+                            lvi.iSubItem = pnmv->iSubItem;
+                            lvi.cchTextMax = _countof(szDriverPath);
+                            lvi.pszText = szDriverPath;
+                            SendMessageW(hDriversListView,
+                                         LVM_GETITEMTEXTW,
+                                         pnmv->iItem,
+                                         reinterpret_cast<WPARAM>(&lvi));
 
                             UpdateDriverVersionInfoDetails(hwndDlg,
                                                            szDriverPath);
@@ -1944,16 +1947,11 @@ AdvProcDetailsDlgProc(IN HWND hwndDlg,
                         if (nSelectedId < 0 || nSelectedItems <= 0)
                             break;
 
-                        TCHAR szItemName[MAX_PATH];
                         HGLOBAL hGlobal;
                         LPWSTR pszBuffer;
+                        LV_ITEMW lvi = { 0 };
 
-                        ListView_GetItemText(hwndListView,
-                                             nSelectedId, 0,
-                                             szItemName,
-                                             _countof(szItemName));
-
-                        hGlobal = GlobalAlloc(GHND, MAX_PATH);
+                        hGlobal = GlobalAlloc(GHND, MAX_PATH * sizeof(WCHAR));
                         if (!hGlobal)
                             break;
                         pszBuffer = (LPWSTR)GlobalLock(hGlobal);
@@ -1963,7 +1961,13 @@ AdvProcDetailsDlgProc(IN HWND hwndDlg,
                             break;
                         }
 
-                        wsprintf(pszBuffer, L"%s", szItemName);
+                        lvi.iSubItem = 0;
+                        lvi.cchTextMax = MAX_PATH;
+                        lvi.pszText = pszBuffer;
+                        SendMessageW(hwndListView,
+                                     LVM_GETITEMTEXTW,
+                                     nSelectedId,
+                                     reinterpret_cast<WPARAM>(&lvi));
 
                         GlobalUnlock(hGlobal);