04 November 2007

MAX_PATH and the secret life of backslash-backslash-questionmark-blackslash

So in Windows, specifically in the Shell API there is the concept of MAX_PATH, which obviously is the maximum path isn't it? Well no, actually, it isn't ;]

If you prepend the string "\\?\" to a path and call the unicode version of the function, you can access files and directories with names up to something like 32,000 wide characters.

This can in turn lead to incorrect file access (which can result in a lot of problems), or for a host of API calls that take an output buffer and output buffer size parameter, a 'buffer is too small' return value which is larger than the original output buffer size.

That is to say you should be calling the APIs in the following way:

DWORD siz = len;
DWORD retval = SomethingWithALongNameW(..., siz)

if (0 == retval)
// error
if (retval > siz)
// resize buffer or error


But I'm seeing that in a lot of cases, thats not how people are calling it, they're instead calling it closer to this:

if (0 != SomethingWithALongNameW(..., siz) {
// !error



When you do that, you end up with a condition where the buffer being passed in as an output isn't initialized to any value, and the return value is not properly checked and no way to truly know whether the value was initialized or not.

The second half of the problem comes from the fact that a lot of those same API calls will truncate @ MAX_PATH, potentially leading to conditions where files are accessed incorrectly, think of this in the context of signing of verifying the signature of a file where the path length that gets truncated is not the one that gets employed, or the return value is there also improperly checked.

Seriously, try this out- open visual studio and create a directory structure thats like C:\0\1\2\3\4\5\6 , et cetera, create it longer than MAX_PATH, and then try to access it via say cmd.exe or even explorer.exe, try to delete it using either of those, well not cmd.exe, but you'll see why there. (ed note to the lazy reader, everything breaks)

14 comments:

products said...

China Wholesale has been described as the world’s factory. This phenomenom is typified by the rise ofbusiness. Incredible range of products available with China Wholesalers “Low Price and High Quality” not only reaches directly to their target clients worldwide but also ensures that wholesale from china from China means margins you cannot find elsewhere and buy products wholesaleChina Wholesale will skyroket your profits.wedding dressescheap naruto cosplayanime cosplaycheap Gemstone Jewelry

products said...

Women’s nike tn Shox Rivalry est le modèle féminin le plus tendance de baskets pour le sport. tn chaussuresConcernant la semelle :spyder jacketsCheap Brand Jeans Shop - True Religion Jeans cheap nike shox & Puma Shoes Online- tn nike,Diesel Jeans le caoutchouc extérieur, l’EVA intermédiaire Levis Jeanset le textile intérieur s’associent pour attribuer à la.ed hardy shirts pretty fitCharlestoncheap columbia jackets. turned a pair of double plays to do the trick.Lacoste Polo Shirts, puma basket, Burberry Polo Shirts.wholesale Lacoste polo shirts and cheap polo shirtswith great price.Thank you so much!!cheap polo shirts men'ssweate,gillette mach3 razor bladesfor men.As for Cheap Evisu JeansCheap Armani Jeanspolo shirtsPuma shoes

uwanna said...

gucci replica handbags
men gucci shoes
Gucci men sneakers
Gucci men moccasins
gucci women sneakers
gucci women boots
Gucci men boots
Gucci
Gucci shop
Gucci bags
Gucci shoes
Replica GUCCI SHOES
wholesale gucci shoes
cheap Gucci handbags
Gucci ON sale
Gucci Belts
Gucci small accessories
Gucci hats & scarves
Gucci wallets
Gucci Handbags
Women Gucci shoes
Men Gucci shoes
discount gucci shoes
cheap Gucci shoes

ally said...

Fashion is all about lookingwholesale LV handbagsmoncler jackets good and being comfortable at the same time. monclermoncler coatsEvery woman loves being complimentedmoncler t-shirtmoncler vestmoncler outlet for her sense of style and elegance. ugg bootscheap ugg bootsdiscount ugg bootsNo woman wants to be labeled as outdated and old fashioned.ugg classic tall bootsclassic ugg bootsWomen are expected to be in constant touch with the latest trends in ordermoncler jacketsmonclernew moncler coats to adopt those trends and look fashionable and stylish. moncler vestmoncler outletmoncler polo t-shirtWomen need to make sure that whatever they wear, coach outletcoach handbagscoach bagsit should compliment their personality and they do not feel awkward while wearing it. coach totescoach outletlouis vuitton handbagsAn article about Gothic costume clothing and the importance of choosing Gothic choker. LV handbags 2010Louis Vuitton bagsLouis Vuitton totesThis article explores the wide variety of Gothicrain boots
rainweardiesel jeans chokers available from everyday to special occasions. Ture Religion Jeanslevis jeansabercrombie and fitch outletIt should inspire people to go shopping for their own Gothic chokers. ed hardy wholesaleed hardy outletcheap ed hardy wholesaleThe origins of the Flat cap span discount ed hardy wholesalewholesale ed hardy

GUCCI BOSS said...

coach coupons
coach backpack
New Coach Bag
bags cheap
Coach Classic
coach discount
Coach Handbags
coach purses cheap
Coach Purses

coach poppy
Coach Tote
coach outlet store
coach store
Coach Wallets

Coach Luggage
Coach leather bag
Coach Sandals
Coach Jewelry
Coach Accessories
Coach Sunglasses
Coach glasses

Coach Bags
Coach Handbags
Coach Purses
Coach Outlet
Coach Purses Outlet
Coach Bags Outlet
Coach Wholesale

hxl said...

baby bedding
bed in a bag
sexual health
health plan
beauty cosmetics
skin care
health fitness sports
mens health
fashion shoes reviews
best air shoes
best women shoes
fashion dress
comfortable man shoes
fashion shoes
sneakers reviews
top ten boots
boots of world
rosetta stone
boots classic
wholesale lots
china wholesaler
china wholesale
wedding dress
lightinthebox reviews
fashion shoes

polo shirts said...

History of polo ralph lauren. Polo fashions had its humble beginnings in 1968 when tie salesman Ralph Lauren gave it a kick start. By 1969 he had a boutique polo ralph lauren factory stores within the Manhattan department store Bloomingdale's. ... Brands and luxury standard. Since Ralph Lauren's first brand, Polo Ralph Lauren, was launched, the company has expanded to include a variety of luxury brands such as Polo Golf, Polo Denim, Polo Sport. You can buy cheap Ralph Lauren Clothing at Ralph Lauren outlet.Also We provide polo shirts
Ralph Lauren polo shirt, 50% OFF! polo ralph lauren outlet online is your best choice!In 2006, polo ralph lauren outlet became the first designer in Wimbledon's 133-year history to create official uniforms for the tournament. As part of this year's event, which starts next week, polo ralph lauren sale will introduces the first ... determination to maintain and enhance the values for which our two brands are famous throughout the world. The rugby ralph lauren brand brings to Wimbledon the look of timeless elegance, drawing on our rich history and traditions

boshi said...

2010 your best choice for christmas gift. First, Power Balance silicone Bracelets. They are are sweeping the whole world.
power balance bracelets were first released in January of 2007 and now they become the most popular health bracelets among people of all ages and all walks of life, including some of the super athletes.

Second, Silly bandz. A very famous brand of silicon rubber bands. bakugan toys
silly bandz come in different shapes like objects, animals and letters and this is why these are loved by kids of all ages. The bands are very popular because they come in many colors, shapes and themes. There is no doubt that you will fall in love with them the minute you see them. These bands can wither be used as bracelets or as regular rubber bands. The choice is entirely of the user.

Third, Far away on the mysterious Isle of Zoobles reside hundreds of adorable, little creatures with a magnificent ability, they can magically transform into tiny balls hiding from the unknown, rolling to colorful destinations, sleeping after a long day But beware, you never know when these mischievous Zoobles are going to pop open and surprise you.

Fourth, EFX’s holographic technology contains algorithms and frequencies that interact positively with this energy field in both humans and animals at the cellular level. When placed near the body, especially at key energy centers such as the hands and feet, EFX bracelet’s products will harmonize with the body’s naturally occurring bioelectric frequencies.

weddingdresses said...

The Power Balance bracelet is made of pure surgical grade silicone that is extremely durable. Its stretch feature optimizes users' comfort level. It comes equipped with two, visible power balance holograms and this sporty and stylish bracelet goes with everything.

Specification:

Silicone Power Balance Wristband Bracelet
The band made of 100% silicone rubber
With 2 visible hologram disks for balance power,waterproof.


Except for this product,customers are eager to shop for:

Silly Bandz
Moncler Jackets
Reebok Easytone

aiya said...

Office 2010
Microsoft Office 2010
Microsoft word
Office 2007
Microsoft Office
Microsoft Office 2007
Office 2007 key
Office 2007 download
Office 2007 Professional
Outlook 2010
Microsoft outlook
Microsoft outlook 2010
Windows 7

pandorasell said...

Silver pandora jewelry store comprises replacement atomic number 79 equally the metal by choice in that pandora jewelry website flavors manners. .925 alright superlative Ag Jewelry checks 92.5% complete silver pandora jewelry online and comprises assorted with extra debases to beef up them and abbreviate maculating pandora style jewelry coming through a hard-nosed alloy as pandora bracelet beads . The rise in metal prices, especially gold, have begun to alter pandora leather bracelet dashes. Designers are applying sterling pandora style bracelet a lot of today because of its gold pandora bracelet appeal and affordability. Designers care Jacques Louis pandora charm necklace David Yurman and those from pandora’s cause changed their focus and are making A-list assembles by .925 Fine Sterling pandora necklace charms Although Silver is affordable its price has quietly risen 300% inch the last 5 years and is astir across 50% pandora silver beads these class entirely. Many investment advisers* recommend a portion of your wealth be inward Ag and amber. Trend setters who comprised the first to begin wearing pandora necklace leather metal to match tatto last word and additional electric current styles as well do good along accepting pandora bracelet charms worth more than they paid for it.

sweet said...

Supra Shoes will have a different look for sneakers – a variety of Supra Shoes.These new designs and a variety of vaider shoes appear together before,so this pair of shoes with a sudden high eight inches out of the name.

qinbincai123 said...

You see: The beauty of a woman is not in the clothes she wears,
the figure that she carries, kirefg88 or the way she combs her hair.
Wholesale New Era Hats
Cheap 59fifty Hats
Cheap New Era Hats
New Era Snapback Hats
New Era Fitted Hats

Jerry Gene said...

I really like your writing style. Nice Post keep it up.

Asus - K53E-DS31 15.6" LED Notebook - Intel Core i3 i3-2350M 2.30 GHz - Mocha

Asus - 14" Notebook 4 GB Memory - 500 GB Hard Drive - Black (P43E-XH31)