Robert Shearman : msi: Fix heap overflow in ITERATE_CreateShortcuts.

[Alexandre Julliard]

Module: wine
Branch: refs/heads/master
Commit: 4ac8567497737ae7bc6f2d4fcbfc1a53e0c903ea
URL:    http://source.winehq.org/git/?p=wine.git;a=commit;h=4ac8567497737ae7bc6f2d4fcbfc1a53e0c903ea

Author: Robert Shearman <rob at codeweavers.com>
Date:   Wed Feb 22 16:31:00 2006 +0000

msi: Fix heap overflow in ITERATE_CreateShortcuts.

---

 dlls/msi/action.c |   12 +++++++++---
 1 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/dlls/msi/action.c b/dlls/msi/action.c
index 636f01c..9f342e6 100644
--- a/dlls/msi/action.c
+++ b/dlls/msi/action.c
@@ -2815,7 +2815,7 @@ static UINT ITERATE_CreateShortcuts(MSIR
 {
     MSIPACKAGE *package = (MSIPACKAGE*)param;
     LPWSTR target_file, target_folder, filename;
-    LPCWSTR buffer;
+    LPCWSTR buffer, extension;
     MSICOMPONENT *comp;
     static const WCHAR szlnk[]={'.','l','n','k',0};
     IShellLinkW *sl;
@@ -2864,8 +2864,14 @@ static UINT ITERATE_CreateShortcuts(MSIR
 
     filename = msi_dup_record_field( row, 3 );
     reduce_to_longfilename(filename);
-    if (!strchrW(filename,'.') || strcmpiW(strchrW(filename,'.'),szlnk))
-        strcatW(filename,szlnk);
+
+    extension = strchrW(filename,'.');
+    if (!extension || strcmpiW(extension,szlnk))
+    {
+        int len = strlenW(filename);
+        filename = msi_realloc(filename, len * sizeof(WCHAR) + sizeof(szlnk));
+        memcpy(filename + len, szlnk, sizeof(szlnk));
+    }
     target_file = build_directory_name(2, target_folder, filename);
     msi_free(target_folder);
     msi_free(filename);