Name: wm7046 Date: 12/08/2000


This is a related bug of 4265922.

Please see the following source code (from awt_FileDialog.cpp of JDK 1.3.0).

Thanks to the bug fix of 4265922, the length of the title buffer becomes length * 2 + 1 (the first '!'). However, the length of the directory buffer is still length + 1 (the second '!').

In Windows Japanese, 2-byte characters can be used for the directory name. So this code still have the possibility of abnormal termination. The length of the directory buffer should be length * 2 + 1.

----------------------------------------------------------------------
void
AwtFileDialog::Show(void *p)
{
    ....
    try {
        DASSERT(peer);
        target = env->GetObjectField(peer, AwtObject::targetID);
        parent = env->GetObjectField(peer, AwtFileDialog::parentID);
        if (parent != NULL) {
            awtParent = (AwtComponent *)JNI_GET_PDATA(parent);
        }
        DASSERT(awtParent);
        title = (jstring)(env)->GetObjectField(target, AwtDialog::titleID);
        if (title != NULL) {
            int length = env->GetStringLength(title);
! titleBuffer = new char[length * 2 + 1];

            AwtFont::javaString2multibyte(env, title, titleBuffer, length);
        }

        directory =
            (jstring)env->GetObjectField(target, AwtFileDialog::dirID);
        if (directory != NULL) {
            int length = env->GetStringLength(directory);
! directoryBuffer = new char[length + 1];

            AwtFont::javaString2multibyte(env, directory, directoryBuffer,
                                          length);
        }
        ...
----------------------------------------------------------------------
(Review ID: 113293)
======================================================================