[bug2796] Richedit bug

[Ann and Jason Edmeades]

Nice bug:

WCHAR *p = ALLOC_N_OBJ(WCHAR, nLen+1);
#define ALLOC_N_OBJ(type, count) (type *)HeapAlloc(me_heap, 0,
count*sizeof(type))

becomes
(WCHAR *)HeapAlloc(me_heap, 0, nLen+1*sizeof(WCHAR))

and by precedence rules means we allocate just nLen + 2 bytes rather than 2
* (nLen+1)

Changelog

Correct memory allocation routine


Krzysztof - Does this solve the issue in the comment below it, ie the memory
overrun?

Jason

-------------- next part --------------
A non-text attachment was scrubbed...
Name: bug2796.patch
Type: application/octet-stream
Size: 613 bytes
Desc: not available
Url : http://www.winehq.org/pipermail/wine-patches/attachments/20050316/79ad5da9/bug2796.obj