Buffer overrun bug in ATL CPath functions.

[John Hensley]

There are a couple of bugs in the atlpath.h file that ships with
DevStudio 2003 and DevStudio 2005 Beta 1 & 2. These bugs result in
buffer overrun and memory corruption problems. After experiencing some
memory corruption I traced the problems to CPathT::AddBackslash() and
CPathT::Append(). These are offending lines in each of the functions
along with an explanation of what is wrong with them.

void AddBackslash()
{
...
// Buffer will be large enough for the appended backslash but not
// the ‘\0’ string terminator
pszBuffer = m_strPath.GetBuffer( m_strPath.GetLength()+1 );
...
}

BOOL Append( __in PCXSTR pszMore )
{
...
// Buffer will be large enough for both strings and the separating
// backslash but not the ‘\0’ string terminator
pszBuffer = m_strPath.GetBuffer( m_strPath.GetLength()

+StringType::StringLength(

pszMore)+1);
...
}

It would be great if these 2 problems could be fixed in the Devstudio
2005 RTM.

Regards,
John Hensley
SmartSoft

[Carl Daniel [VC++ MVP]]

John Hensley wrote:

There are a couple of bugs in the atlpath.h file that ships with
DevStudio 2003 and DevStudio 2005 Beta 1 & 2. These bugs result in
buffer overrun and memory corruption problems. After experiencing some
memory corruption I traced the problems to CPathT::AddBackslash() and
CPathT::Append(). These are offending lines in each of the functions
along with an explanation of what is wrong with them.

void AddBackslash()
{
...
// Buffer will be large enough for the appended backslash but not
// the '\0' string terminator
pszBuffer = m_strPath.GetBuffer( m_strPath.GetLength()+1 );
...
}

BOOL Append( __in PCXSTR pszMore )
{
...
// Buffer will be large enough for both strings and the separating
// backslash but not the '\0' string terminator
pszBuffer = m_strPath.GetBuffer( m_strPath.GetLength()

+StringType::StringLength(

pszMore)+1);
...
}

It would be great if these 2 problems could be fixed in the Devstudio
2005 RTM.

Please post a bug report at http://lab.msdn.microsoft.com/productfeedback/

-cd