Truncate file name longer than MAX_PATH(260) on D2D

ui/base/dragdrop/os_exchange_data_provider_win.cc

Index: ui/base/dragdrop/os_exchange_data_provider_win.cc
diff --git a/ui/base/dragdrop/os_exchange_data_provider_win.cc b/ui/base/dragdrop/os_exchange_data_provider_win.cc
index 3ecbefa33ae8cddf3af54c9ddd2258187e3f0922..a502bff62bb42ed3b0ba77ca6f2ac07c1a7d72d3 100644
--- a/ui/base/dragdrop/os_exchange_data_provider_win.cc
+++ b/ui/base/dragdrop/os_exchange_data_provider_win.cc
@@ -4,6 +4,9 @@
 
 #include "ui/base/dragdrop/os_exchange_data_provider_win.h"
 
+#include <algorithm>
+#include <vector>
+
 #include "base/file_path.h"
 #include "base/i18n/file_util_icu.h"
 #include "base/logging.h"
@@ -124,7 +127,7 @@ STDMETHODIMP FormatEtcEnumerator::Next(
     ULONG count, FORMATETC* elements_array, ULONG* elements_fetched) {
   // MSDN says |elements_fetched| is allowed to be NULL if count is 1.
   if (!elements_fetched)
-    DCHECK(count == 1);
+    DCHECK_EQ(count, 1ul);
 
   // This method copies count elements into |elements_array|.
   ULONG index = 0;
@@ -403,7 +406,7 @@ bool OSExchangeDataProviderWin::GetPickledData(CLIPFORMAT format,
   if (SUCCEEDED(source_object_->GetData(&format_etc, &medium))) {
     if (medium.tymed & TYMED_HGLOBAL) {
       base::win::ScopedHGlobal<char> c_data(medium.hGlobal);
-      DCHECK(c_data.Size() > 0);
+      DCHECK_GT(c_data.Size(), static_cast<size_t>(0));
       // Need to subtract 1 as SetPickledData adds an extra byte to the end.
       *data = Pickle(c_data.get(), static_cast<int>(c_data.Size() - 1));
       success = true;
@@ -911,15 +914,28 @@ static STGMEDIUM* GetStorageForFileName(const FilePath& path) {
 static STGMEDIUM* GetStorageForFileDescriptor(
     const FilePath& path) {
   string16 valid_file_name = path.value();
-  DCHECK(!valid_file_name.empty() && valid_file_name.size() + 1 <= MAX_PATH);
+  DCHECK(!valid_file_name.empty());
   HANDLE handle = GlobalAlloc(GPTR, sizeof(FILEGROUPDESCRIPTOR));
   FILEGROUPDESCRIPTOR* descriptor =
       reinterpret_cast<FILEGROUPDESCRIPTOR*>(GlobalLock(handle));
 
   descriptor->cItems = 1;
-  wcscpy_s(descriptor->fgd[0].cFileName,
-           valid_file_name.size() + 1,
-           valid_file_name.c_str());
+  {
+    string16 extension = path.Extension();
+    int extension_len = extension.size();
+    size_t max_name_len = MAX_PATH - extension_len - 1;

[sky, 2011/09/06 15:55:05]

Is it possible that extension_len is >= MAX_PATH - 1, which would cause overflow
for size_t?

+    size_t orig_name_len = valid_file_name.size() - extension_len;
+    int name_len = std::min(max_name_len, orig_name_len);
+
+    memcpy(descriptor->fgd[0].cFileName,
+           valid_file_name.c_str(),
+           sizeof(wchar_t) * name_len);
+
+    wcscpy_s(descriptor->fgd[0].cFileName + name_len,
+             extension_len + 1,
+             extension.c_str());
+  }
+
   descriptor->fgd[0].dwFlags = FD_LINKUI;
 
   GlobalUnlock(handle);
@@ -931,7 +947,6 @@ static STGMEDIUM* GetStorageForFileDescriptor(
   return storage;
 }
 
-
 ///////////////////////////////////////////////////////////////////////////////
 // OSExchangeData, public: