Hans Leidekker : msi: Avoid accessing memory before the left hand string in compare_substring.
Alexandre Julliard
julliard at winehq.org
Fri Sep 24 11:43:47 CDT 2010
Module: wine
Branch: master
Commit: e58a67e9cd19bc1aef646e8f3fadaf0c490b38de
URL: http://source.winehq.org/git/wine.git/?a=commit;h=e58a67e9cd19bc1aef646e8f3fadaf0c490b38de
Author: Hans Leidekker <hans at codeweavers.com>
Date: Fri Sep 24 17:09:04 2010 +0200
msi: Avoid accessing memory before the left hand string in compare_substring.
---
dlls/msi/cond.y | 14 ++++++++++++--
1 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/dlls/msi/cond.y b/dlls/msi/cond.y
index 9a7a16d..03ea493 100644
--- a/dlls/msi/cond.y
+++ b/dlls/msi/cond.y
@@ -462,11 +462,21 @@ static INT compare_substring( LPCWSTR a, INT operator, LPCWSTR b )
case COND_LHS:
return 0 == strncmpW( a, b, lstrlenW( b ) );
case COND_RHS:
- return 0 == lstrcmpW( a + (lstrlenW( a ) - lstrlenW( b )), b );
+ {
+ int l = lstrlenW( a );
+ int r = lstrlenW( b );
+ if (r > l) return 0;
+ return 0 == lstrcmpW( a + (l - r), b );
+ }
case COND_ILHS:
return 0 == strncmpiW( a, b, lstrlenW( b ) );
case COND_IRHS:
- return 0 == lstrcmpiW( a + (lstrlenW( a ) - lstrlenW( b )), b );
+ {
+ int l = lstrlenW( a );
+ int r = lstrlenW( b );
+ if (r > l) return 0;
+ return 0 == lstrcmpiW( a + (l - r), b );
+ }
default:
ERR("invalid substring operator\n");
return 0;
More information about the wine-cvs
mailing list