1 files changed, 8 insertions, 4 deletions
diff --git a/chrome/common/win_util.cc b/chrome/common/win_util.cc
index 7bcd55d..36e1f86 100644
--- a/chrome/common/win_util.cc
+++ b/chrome/common/win_util.cc
@@ -395,11 +395,15 @@ bool SaveFileAsWithFilter(HWND owner,
 
   // Initially populated by the file component of 'suggested_name', this buffer
   // will be written into by Windows when the user is done with the dialog box.
-  wchar_t file_name[MAX_PATH+1];
   std::wstring file_part = file_util::GetFilenameFromPath(suggested_name);
-  memcpy(file_name,
-         file_part.c_str(),
-         (file_part.length()+1) * sizeof(wchar_t));
+
+  // This will clamp the number of characters copied from the supplied path
+  // to the value of MAX_PATH.
+  size_t name_size = std::min(file_part.length() + 1,
+                              static_cast<size_t>(MAX_PATH));
+  wchar_t file_name[MAX_PATH];
+  memcpy(file_name, file_part.c_str(), name_size * sizeof(wchar_t));
+  file_name[MAX_PATH - 1] = '\0';
 
   OPENFILENAME save_as;
   // We must do this otherwise the ofn's FlagsEx may be initialized to random