[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wine-devel
Subject:    Re: [PATCH] msi: Fix a buffer overrun.
From:       Austin English <austinenglish () gmail ! com>
Date:       2017-06-29 16:27:24
Message-ID: CACC5Q1cQS6viCC+qQ8r7k1jxV+rRXUf9AZ+G81g2Dh0KsqcKGg () mail ! gmail ! com
[Download RAW message or body]

On Thu, Jun 29, 2017 at 12:09 AM, Zebediah Figura <z.figura12@gmail.com> wrote:
> Fixes https://bugs.winehq.org/show_bug.cgi?id=43257
> 
> Signed-off-by: Zebediah Figura <z.figura12@gmail.com>
> ---
> dlls/msi/package.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/dlls/msi/package.c b/dlls/msi/package.c
> index bf6ae10..3a75a1c 100644
> --- a/dlls/msi/package.c
> +++ b/dlls/msi/package.c
> @@ -1812,17 +1812,17 @@ INT MSI_ProcessMessage( MSIPACKAGE *package, INSTALLMESSAGE \
> eMessageType, MSIREC {
> WCHAR template_s[1024];
> WCHAR *template_rec, *template;
> -        DWORD length;
> 
> LoadStringW(msi_hInstance, IDS_INFO, template_s, 1024);
> 
> -        res = MSI_RecordGetStringW(record, 0, NULL, &length);
> +        res = MSI_RecordGetStringW(record, 0, NULL, &len);
> if (res != ERROR_SUCCESS && res != ERROR_MORE_DATA)
> return res;
> len++;
> template_rec = msi_alloc(len * sizeof(WCHAR));
> if (!template_rec) return ERROR_OUTOFMEMORY;
> -        MSI_RecordGetStringW(record, 0, template_rec, &length);
> +        MSI_RecordGetStringW(record, 0, template_rec, &len);
> +        len++;
> 
> template = msi_alloc((len + strlenW(template_s)) * sizeof(WCHAR));
> if (!template) return ERROR_OUTOFMEMORY;
> --
> 2.7.4
> 
> 
> 

Works for me, thanks.

-- 
-Austin
GPG: 14FB D7EA A041 937B


[prev in list] [next in list] [prev in thread] [next in thread]