Juan Lang : crypt32: Don' t copy past end of buffer when removing the last string in a multistring.
Alexandre Julliard
julliard at winehq.org
Thu Nov 5 10:50:01 CST 2009
Module: wine
Branch: master
Commit: 88e599c4cf118d323b4566e7f456dcaf5ba309be
URL: http://source.winehq.org/git/wine.git/?a=commit;h=88e599c4cf118d323b4566e7f456dcaf5ba309be
Author: Juan Lang <juan.lang at gmail.com>
Date: Wed Nov 4 16:29:33 2009 -0800
crypt32: Don't copy past end of buffer when removing the last string in a multistring.
---
dlls/crypt32/oid.c | 15 ++++++++++++---
1 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/dlls/crypt32/oid.c b/dlls/crypt32/oid.c
index ddc6efc..0a3889d 100644
--- a/dlls/crypt32/oid.c
+++ b/dlls/crypt32/oid.c
@@ -873,9 +873,18 @@ static BOOL CRYPT_RemoveStringFromMultiString(LPWSTR multi, LPCWSTR toRemove)
{
DWORD len = CRYPT_GetMultiStringCharacterLen(multi);
- /* Copy remainder of string "left" */
- memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
- (len - (spotToRemove - multi)) * sizeof(WCHAR));
+ if (spotToRemove + lstrlenW(toRemove) + 2 >= multi + len)
+ {
+ /* Removing last string in list, terminate multi string directly */
+ *spotToRemove = 0;
+ *(spotToRemove + 1) = 0;
+ }
+ else
+ {
+ /* Copy remainder of string "left" */
+ memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
+ (len - (spotToRemove - multi)) * sizeof(WCHAR));
+ }
ret = TRUE;
}
else
More information about the wine-cvs
mailing list