Potential buffer overflow on receiving name for hot key combinations

[topeterk]

Not sure what the default capacity of a default constructed StringBuilder class as stringbuilder.-ctor documentation says "the capacity is set to the implementation-specific default capacity."
However, the native Win32 API call GetKeyNameText requires that the given buffer size must be at least as big as the amount given in the third parameter.
In version 1 this is 100 in multiple places and may lead to buffer overflows in case the resulting key names are longer than the actual allocated memory:

SystemTrayMenu/UserInterface/HotkeyTextboxControl/HotkeyControl.cs

Line 304 in 4cf4b98

StringBuilder keyName = new();

SystemTrayMenu/UserInterface/HotkeyTextboxControl/HotkeyControl.cs

Line 323 in 4cf4b98

if (NativeMethods.User32GetKeyNameText(numpad << 16, keyName, 100) > 0)

Suggestion, use defined capacity and pass actual buffer size to native call (as here in v2 example):

SystemTrayMenu/Helpers/GlobalHotkeys.cs

Line 187 in 60329d5

StringBuilder keyName = new(100);

SystemTrayMenu/Helpers/GlobalHotkeys.cs

Line 193 in 60329d5

if (NativeMethods.User32GetKeyNameText(scanCodeNumPad << 16, keyName, keyName.Capacity) > 0)