Browse for folder Xp Crash

[ragdog]

Hi

I have a routine Browse for folder under xp-sp2 works fine
Why crash this under xp-without sp2?

Code Select Expand


_GetOpenDirectoryName proc uses esi, hWnd:DWORD
LOCAL binfo:BROWSEINFO
LOCAL lpIDList :DWORD

mov eax, hWnd
    mov binfo.hwndOwner, eax
    mov binfo.pidlRoot, 0
    mov binfo.pszDisplayName, 0

    mov binfo.lpszTitle,offset szBrowseTitle
    mov binfo.iImage, 0
mov binfo.ulFlags, BIF_RETURNONLYFSDIRS or BIF_DONTGOBELOWDOMAIN or BIF_RETURNONLYFSDIRS
    invoke SHBrowseForFolder, addr binfo
mov lpIDList, eax

    .if eax != 0
        invoke  SHGetPathFromIDList, lpIDList , addr bbf 
        invoke  lstrlen,addr  bbf     
           mov  esi,offset bbf   
           add  esi,eax                     
           cmp  byte ptr [esi-1], '\'       
            je  @F
           mov  byte ptr [esi], '\'
           mov  byte ptr [esi+1], 0
        @@:
           mov  eax,offset bbf
    .endif
   ret
_GetOpenDirectoryName endp


This Crash by xp without sp here in the Shell32.dll

Code Select Expand


774B0D5C SHEnableServiceObject    XOR EAX,EAX
774B0D5E                          CMP DWORD PTR SS:[ESP+8],EAX
774B0D62                          SETNE AL
774B0D65                          INC EAX
774B0D66                          INC EAX
774B0D67                          PUSH EAX
774B0D68                          PUSH DWORD PTR SS:[ESP+8]
774B0D6C                          CALL 774B0CF5
774B0D71                          RETN 8
774B0D74                          MOV EAX,DWORD PTR SS:[ESP+4]
774B0D78                          MOV ECX,DWORD PTR DS:[EAX+18]
774B0D7B                          TEST ECX,ECX <-------- = 0F
774B0D7D                          JE SHORT 774B0D91 <-------- ----------------------------
774B0D7F                          PUSH DWORD PTR DS:[EAX+1C]
774B0D82                          PUSH DWORD PTR SS:[ESP+10]
774B0D86                          PUSH DWORD PTR SS:[ESP+10]
774B0D8A                          PUSH DWORD PTR DS:[EAX+20]
774B0D8D                          CALL ECX
774B0D8F                          JMP SHORT 774B0D93
774B0D91                          XOR EAX,EAX
774B0D93                          RETN 0C


TEST ECX,ECX // ECX = 0000000F



Greets,

[askm]

OllyDbg ?

How is the register ecx being used while in your proc ?
   ...while in XP with SP2 ?
   ...while in XP with SP3 ?
   ...while Win 2000 SP4 ?

Should it hold a dword size value at all times when
being referenced ?

Should it be pushed or popped ?

Can you post a real usage snippet ?

[donkey]

Be sure to zero BROWSEINFO.lpfn which I suspect is your problem, when you use a LOCAL structure there is bound to be random data in the structure.

Donkey

[askm]

Some say zero or NULL the entire BROWSEINFO structure ...

[donkey]

Some say zero or NULL the entire BROWSEINFO structure ...

He explicitly sets the rest of the members though it wouldn't hurt to zero everything it is not necessary in this case.

[ragdog]

Thanks for your Reply

Mean you this?
mov bi.lpfn, offset cbBrowse

And must i set this?
invoke CoTaskMemFree,lpIDList

Regards,

[donkey]

Thanks for your Reply

Mean you this?
mov bi.lpfn, offset cbBrowse

No, I mean mov bi.lpfn, 0

And must i set this?
invoke CoTaskMemFree,lpIDList,

Yes, you must free the memory allocated to the ID list

[ragdog]

Thanks for this info

Gives a way to add a Combobox to this browser dialog with the Browser Callback?
with CreateWindow....

Greets