[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wine-devel
Subject:    advapi32: fix buffer overrun in tests/registry.c:wine_debugstr_wn(),
From:       "Dan Kegel" <dank () kegel ! com>
Date:       2007-10-31 6:04:36
Message-ID: a71bd89a0710302304v3d51bf77y60dc8320f3605ba8 () mail ! gmail ! com
[Download RAW message or body]

OK, my last try was ugly and deserved to be dropped.
This one is a one-bit change, and easier to understand.

Fixes an off-by-one buffer overflow in wine_debugstr_wn()
in which the wchar after the end of the buffer was read.

["advapi32-debugstr.patch" (text/x-patch)]

diff --git a/dlls/advapi32/tests/registry.c b/dlls/advapi32/tests/registry.c
index 017dab3..63bdfce 100644
--- a/dlls/advapi32/tests/registry.c
+++ b/dlls/advapi32/tests/registry.c
@@ -126,7 +126,7 @@ static const char *wine_debugstr_wn( const WCHAR *str, int n )
     dst = res = get_temp_buffer( n * 5 + 7 );
     *dst++ = 'L';
     *dst++ = '"';
-    while (n-- > 0)
+    while (n-- > 1)
     {
         WCHAR c = *str++;
         switch (c)




[prev in list] [next in list] [prev in thread] [next in thread]