[Bug 13319] In dlls/user32/edit.c EDIT_EM_ReplaceSel Clobbers Important Var When Buffer Overflows

[wine-bugs at winehq.org]

http://bugs.winehq.org/show_bug.cgi?id=13319





--- Comment #18 from Bob Smith <bsmith at sudleyplace.com>  2008-05-30 11:04:12 ---
(In reply to comment #14)
> Created an attachment (id=13472)
 --> (http://bugs.winehq.org/attachment.cgi?id=13472) [details]
> edit.c patch
> 
> Your patch breaks the user32 unit tests. I added a bit more debug output to
> your test app and ran it on Windows to figure out the proper behavior. I think
> this is it. I'll try to integrate your test into the test suite and then send
> in the patch. Meanwhile, please try out the patch in this attachment.

I'm not sure exactly what broke in unit tests (perhaps you can elaborate), but
the proposed patch doesn't fill the buffer with all of the data.

I added more code to the test case to show the problem.

Fundamentally, any reassignment of <strl> which doesn't depend on
strlenW(lpsz_replace) can't work.


-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.