# HG changeset patch
# User dcherepanov
# Date 1301921550 -14400
# Node ID 049b0098d27c509fd57843ab4ea7aa5fa5fc84bd
# Parent  dc0eabbd9955ebe6a40aa931d6f3333e1f50a1b2
7012520: Heap overflow vulnerability in FileDialog.show()
Reviewed-by: art, anthony

diff --git a/src/windows/native/sun/windows/awt_FileDialog.cpp b/src/windows/native/sun/windows/awt_FileDialog.cpp
--- openjdk/jdk/src/windows/native/sun/windows/awt_FileDialog.cpp
+++ openjdk/jdk/src/windows/native/sun/windows/awt_FileDialog.cpp
@@ -231,11 +231,12 @@ AwtFileDialog::Show(void *p)
         JavaStringBuffer directoryBuffer(env, directory);
 
         fileBuffer = new TCHAR[MAX_PATH+1];
+        memset(fileBuffer, 0, (MAX_PATH+1) * sizeof(TCHAR));
 
         file = (jstring)env->GetObjectField(target, AwtFileDialog::fileID);
         if (file != NULL) {
             LPCTSTR tmp = JNU_GetStringPlatformChars(env, file, NULL);
-            _tcscpy(fileBuffer, tmp);
+            _tcsncpy(fileBuffer, tmp, MAX_PATH-1); // the fileBuffer is double null terminated string
             JNU_ReleaseStringPlatformChars(env, file, tmp);
         } else {
             fileBuffer[0] = _T('\0');