From 0edffb1edaa21788e9e63a7796bfb4621e4a980b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20S=C5=82abo=C5=84?= <asaillen@protonmail.com>
Date: Mon, 29 Dec 2025 21:22:20 +0100
Subject: [PATCH] [NEWDEV] CHSourceDlgProc: Don't set CustomSearchPath member
 to stack allocated buffer (#8447)

Fixes a crash when installing a driver from custom directory.
Also move the combobox handling code to the PrepareFoldersToScan() and call it instead.

CORE-20409
---
 dll/win32/newdev/newdev.c |  8 ++++++--
 dll/win32/newdev/wizard.c | 34 ++++++++++++++--------------------
 2 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/dll/win32/newdev/newdev.c b/dll/win32/newdev/newdev.c
index bd62f858de5..1635bc663fb 100644
--- a/dll/win32/newdev/newdev.c
+++ b/dll/win32/newdev/newdev.c
@@ -473,6 +473,7 @@ PrepareFoldersToScan(
     DWORD CustomTextLength = 0;
     DWORD LengthNeeded = 0;
     LPWSTR Buffer;
+    INT idx = (INT)SendMessageW(hwndCombo, CB_GETCURSEL, 0, 0);
 
     /* Calculate length needed to store the search paths */
     if (IncludeRemovableDevices)
@@ -492,7 +493,8 @@ PrepareFoldersToScan(
     }
     if (IncludeCustomPath)
     {
-        CustomTextLength = 1 + ComboBox_GetTextLength(hwndCombo);
+        CustomTextLength = 1 + ((idx != CB_ERR) ?
+        (INT)SendMessageW(hwndCombo, CB_GETLBTEXTLEN, idx, 0) : ComboBox_GetTextLength(hwndCombo));
         LengthNeeded += CustomTextLength;
     }
 
@@ -526,7 +528,9 @@ PrepareFoldersToScan(
     }
     if (IncludeCustomPath)
     {
-        Buffer += 1 + GetWindowTextW(hwndCombo, Buffer, CustomTextLength);
+        Buffer += 1 + ((idx != CB_ERR) ?
+        SendMessageW(hwndCombo, CB_GETLBTEXT, idx, (LPARAM)Buffer) :
+        GetWindowTextW(hwndCombo, Buffer, CustomTextLength));
     }
     *Buffer = '\0';
 
diff --git a/dll/win32/newdev/wizard.c b/dll/win32/newdev/wizard.c
index 5204bcdf5d2..ef46263a812 100644
--- a/dll/win32/newdev/wizard.c
+++ b/dll/win32/newdev/wizard.c
@@ -684,32 +684,23 @@ CHSourceDlgProc(
                 case IDC_BROWSE:
                 {
                     BROWSEINFOW bi = { 0 };
-                    LPITEMIDLIST pidl;
+                    LPITEMIDLIST pidl = NULL;
                     WCHAR Title[MAX_PATH];
-                    WCHAR CustomSearchPath[MAX_PATH] = { 0 };
-                    INT len, idx = (INT)SendDlgItemMessageW(hwndDlg, IDC_COMBO_PATH, CB_GETCURSEL, 0, 0);
                     LoadStringW(hDllInstance, IDS_BROWSE_FOR_FOLDER_TITLE, Title, _countof(Title));
 
-                    if (idx == CB_ERR)
-                        len = GetWindowTextLengthW(GetDlgItem(hwndDlg, IDC_COMBO_PATH));
-                    else
-                        len = (INT)SendDlgItemMessageW(hwndDlg, IDC_COMBO_PATH, CB_GETLBTEXTLEN, idx, 0);
-
-                    if (len < _countof(CustomSearchPath))
+                    if (PrepareFoldersToScan(DevInstData,
+                        FALSE,
+                        TRUE,
+                        GetDlgItem(hwndDlg, IDC_COMBO_PATH)))
                     {
-                        if (idx == CB_ERR)
-                            GetWindowTextW(GetDlgItem(hwndDlg, IDC_COMBO_PATH), CustomSearchPath, _countof(CustomSearchPath));
-                        else
-                            SendDlgItemMessageW(hwndDlg, IDC_COMBO_PATH, CB_GETLBTEXT, idx, (LPARAM)CustomSearchPath);
+                        bi.hwndOwner = hwndDlg;
+                        bi.ulFlags = BIF_USENEWUI | BIF_RETURNONLYFSDIRS | BIF_STATUSTEXT | BIF_NONEWFOLDERBUTTON;
+                        bi.lpszTitle = Title;
+                        bi.lpfn = BrowseCallbackProc;
+                        bi.lParam = (LPARAM)DevInstData;
+                        pidl = SHBrowseForFolderW(&bi);
                     }
-                    DevInstData->CustomSearchPath = CustomSearchPath;
 
-                    bi.hwndOwner = hwndDlg;
-                    bi.ulFlags = BIF_USENEWUI | BIF_RETURNONLYFSDIRS | BIF_STATUSTEXT | BIF_NONEWFOLDERBUTTON;
-                    bi.lpszTitle = Title;
-                    bi.lpfn = BrowseCallbackProc;
-                    bi.lParam = (LPARAM)DevInstData;
-                    pidl = SHBrowseForFolderW(&bi);
                     if (pidl)
                     {
                         WCHAR Directory[MAX_PATH];
@@ -717,6 +708,9 @@ CHSourceDlgProc(
 
                         if (SHGetPathFromIDListW(pidl, Directory))
                         {
+                            /* Remove previous item selection */
+                            SendDlgItemMessageW(hwndDlg, IDC_COMBO_PATH, CB_SETCURSEL, -1, 0);
+
                             /* Set the IDC_COMBO_PATH text */
                             SetWindowTextW(GetDlgItem(hwndDlg, IDC_COMBO_PATH), Directory);
                         }