Truncate file name longer than MAX_PATH(260) on D2D

ui/base/dragdrop/os_exchange_data_provider_win.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/base/dragdrop/os_exchange_data_provider_win.h"
 
+#include <algorithm>
+#include <vector>
+
 #include "base/file_path.h"
 #include "base/i18n/file_util_icu.h"
 #include "base/logging.h"
 #include "base/memory/scoped_handle.h"
 #include "base/pickle.h"
 #include "base/stl_util.h"
 #include "base/utf_string_conversions.h"
 #include "base/win/scoped_hglobal.h"
 #include "googleurl/src/gurl.h"
 #include "grit/ui_strings.h"
@@ skipping 100 matching lines @@
 }
 
 FormatEtcEnumerator::~FormatEtcEnumerator() {
   STLDeleteContainerPointers(contents_.begin(), contents_.end());
 }
 
 STDMETHODIMP FormatEtcEnumerator::Next(
     ULONG count, FORMATETC* elements_array, ULONG* elements_fetched) {
   // MSDN says |elements_fetched| is allowed to be NULL if count is 1.
   if (!elements_fetched)
-    DCHECK(count == 1);
+    DCHECK_EQ(count, 1ul);
 
   // This method copies count elements into |elements_array|.
   ULONG index = 0;
   while (cursor_ < contents_.size() && index < count) {
     CloneFormatEtc(contents_[cursor_], &elements_array[index]);
     ++cursor_;
     ++index;
   }
   // The out param is for how many we actually copied.
   if (elements_fetched)
@@ skipping 258 matching lines @@
 bool OSExchangeDataProviderWin::GetPickledData(CLIPFORMAT format,
                                                Pickle* data) const {
   DCHECK(data);
   FORMATETC format_etc =
       { format, NULL, DVASPECT_CONTENT, -1, TYMED_HGLOBAL };
   bool success = false;
   STGMEDIUM medium;
   if (SUCCEEDED(source_object_->GetData(&format_etc, &medium))) {
     if (medium.tymed & TYMED_HGLOBAL) {
       base::win::ScopedHGlobal<char> c_data(medium.hGlobal);
-      DCHECK(c_data.Size() > 0);
+      DCHECK_GT(c_data.Size(), static_cast<size_t>(0));
       // Need to subtract 1 as SetPickledData adds an extra byte to the end.
       *data = Pickle(c_data.get(), static_cast<int>(c_data.Size() - 1));
       success = true;
     }
     ReleaseStgMedium(&medium);
   }
   return success;
 }
 
 bool OSExchangeDataProviderWin::GetFileContents(
@@ skipping 487 matching lines @@
   STGMEDIUM* storage = new STGMEDIUM;
   storage->tymed = TYMED_HGLOBAL;
   storage->hGlobal = drop_files;
   storage->pUnkForRelease = NULL;
   return storage;
 }
 
 static STGMEDIUM* GetStorageForFileDescriptor(
     const FilePath& path) {
   string16 valid_file_name = path.value();
-  DCHECK(!valid_file_name.empty() && valid_file_name.size() + 1 <= MAX_PATH);
+  DCHECK(!valid_file_name.empty());
   HANDLE handle = GlobalAlloc(GPTR, sizeof(FILEGROUPDESCRIPTOR));
   FILEGROUPDESCRIPTOR* descriptor =
       reinterpret_cast<FILEGROUPDESCRIPTOR*>(GlobalLock(handle));
 
   descriptor->cItems = 1;
-  wcscpy_s(descriptor->fgd[0].cFileName,
-           valid_file_name.size() + 1,
-           valid_file_name.c_str());
+  {
+    string16 extension = path.Extension();
+    int extension_len = extension.size();
+    size_t max_name_len = MAX_PATH - extension_len - 1;

[sky, 2011/09/06 15:55:05]

Is it possible that extension_len is >= MAX_PATH - 1, which would cause overflow
for size_t?

+    size_t orig_name_len = valid_file_name.size() - extension_len;
+    int name_len = std::min(max_name_len, orig_name_len);
+
+    memcpy(descriptor->fgd[0].cFileName,
+           valid_file_name.c_str(),
+           sizeof(wchar_t) * name_len);
+
+    wcscpy_s(descriptor->fgd[0].cFileName + name_len,
+             extension_len + 1,
+             extension.c_str());
+  }
+
   descriptor->fgd[0].dwFlags = FD_LINKUI;
 
   GlobalUnlock(handle);
 
   STGMEDIUM* storage = new STGMEDIUM;
   storage->hGlobal = handle;
   storage->tymed = TYMED_HGLOBAL;
   storage->pUnkForRelease = NULL;
   return storage;
 }
 
-
 ///////////////////////////////////////////////////////////////////////////////
 // OSExchangeData, public:
 
 // static
 OSExchangeData::Provider* OSExchangeData::CreateProvider() {
   return new OSExchangeDataProviderWin();
 }
 
 // static
 OSExchangeData::CustomFormat OSExchangeData::RegisterCustomFormat(
     const std::string& type) {
   return RegisterClipboardFormat(ASCIIToUTF16(type).c_str());
 }
 
 }  // namespace ui