[PATCH] kernel32: Fixed read overflow in WriteFile argument

Marcus Meissner marcus at jet.franken.de
Wed Jun 20 13:10:12 CDT 2012


Hi,

sizeof(char*) is either 4 or 8 ... On 32bit this worked,
as strlen("test") > 4 ... but not on 64bit.

strlen() was intended I guess.

Ciao, Marcus
---
 dlls/kernel32/tests/pipe.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/dlls/kernel32/tests/pipe.c b/dlls/kernel32/tests/pipe.c
index bd196fe..4af7e9d 100644
--- a/dlls/kernel32/tests/pipe.c
+++ b/dlls/kernel32/tests/pipe.c
@@ -1798,9 +1798,9 @@ static void test_readfileex_pending(void)
     ok(ret == TRUE, "ReadFileEx failed, err=%i\n", GetLastError());
     ok(completion_called == 0, "completion routine called before ReadFileEx returned\n");
 
-    ret = WriteFile(client, test_string, sizeof(test_string), &num_bytes, NULL);
+    ret = WriteFile(client, test_string, strlen(test_string)+1, &num_bytes, NULL);
     ok(ret == TRUE, "WriteFile failed\n");
-    ok(num_bytes == sizeof(test_string), "only %i bytes written\n", num_bytes);
+    ok(num_bytes == strlen(test_string)+1, "only %i bytes written\n", num_bytes);
 
     ok(completion_called == 0, "completion routine called during WriteFile\n");
 
@@ -1809,9 +1809,9 @@ static void test_readfileex_pending(void)
 
     ok(completion_called == 1, "completion not called after writing pipe\n");
     ok(completion_errorcode == 0, "completion called with error %x\n", completion_errorcode);
-    ok(completion_num_bytes == sizeof(test_string), "ReadFileEx returned only %d bytes\n", completion_num_bytes);
+    ok(completion_num_bytes == strlen(test_string)+1, "ReadFileEx returned only %d bytes\n", completion_num_bytes);
     ok(completion_lpoverlapped == &overlapped, "completion called with wrong overlapped pointer\n");
-    ok(!memcmp(test_string, read_buf, sizeof(test_string)), "ReadFileEx read wrong bytes\n");
+    ok(!memcmp(test_string, read_buf, strlen(test_string)+1), "ReadFileEx read wrong bytes\n");
 
     /* Make writes until the pipe is full and the write fails */
     memset(write_buf, 0xaa, sizeof(write_buf));
-- 
1.7.3.4




More information about the wine-patches mailing list