Alex VillacÃs Lasso : winealsa: Ensure that copy_format() will not write past end of
Alexandre Julliard
julliard at wine.codeweavers.com
Wed Jan 11 05:35:28 CST 2006
Module: wine
Branch: refs/heads/master
Commit: 6d88d5ad5cd79d0cc6ee3ddfd4d86f09d9e890f1
URL: http://source.winehq.org/git/?p=wine.git;a=commit;h=6d88d5ad5cd79d0cc6ee3ddfd4d86f09d9e890f1
Author: Alex Villacís Lasso <a_villacis at palosanto.com>
Date: Wed Jan 11 12:33:05 2006 +0100
winealsa: Ensure that copy_format() will not write past end of
referenced WAVEFORMATPCMEX structure.
---
dlls/winmm/winealsa/audio.c | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/dlls/winmm/winealsa/audio.c b/dlls/winmm/winealsa/audio.c
index a64d70e..7beab7b 100644
--- a/dlls/winmm/winealsa/audio.c
+++ b/dlls/winmm/winealsa/audio.c
@@ -404,13 +404,20 @@ static BOOL supportedFormat(LPWAVEFORMAT
static void copy_format(LPWAVEFORMATEX wf1, LPWAVEFORMATPCMEX wf2)
{
+ unsigned int iLength;
+
ZeroMemory(wf2, sizeof(wf2));
if (wf1->wFormatTag == WAVE_FORMAT_PCM)
- memcpy(wf2, wf1, sizeof(PCMWAVEFORMAT));
+ iLength = sizeof(PCMWAVEFORMAT);
else if (wf1->wFormatTag == WAVE_FORMAT_EXTENSIBLE)
- memcpy(wf2, wf1, sizeof(WAVEFORMATPCMEX));
+ iLength = sizeof(WAVEFORMATPCMEX);
else
- memcpy(wf2, wf1, sizeof(WAVEFORMATEX) + wf1->cbSize);
+ iLength = sizeof(WAVEFORMATEX) + wf1->cbSize;
+ if (iLength > sizeof(WAVEFORMATPCMEX)) {
+ ERR("calculated %u bytes, capping to %u bytes\n", iLength, sizeof(WAVEFORMATPCMEX));
+ iLength = sizeof(WAVEFORMATPCMEX);
+ }
+ memcpy(wf2, wf1, iLength);
}
/*----------------------------------------------------------------------------
More information about the wine-cvs
mailing list