Xiaoshan Sun : comctl32/dsa: Handle overflow in DSA_InsertItem().
Alexandre Julliard
julliard at winehq.org
Fri Oct 7 15:09:14 CDT 2016
Module: wine
Branch: stable
Commit: 8f7e06418c06ed41754f9a0b37585ead64cd2ded
URL: http://source.winehq.org/git/wine.git/?a=commit;h=8f7e06418c06ed41754f9a0b37585ead64cd2ded
Author: Xiaoshan Sun <sunxs at is.iscas.ac.cn>
Date: Sun Jul 24 14:44:40 2016 +0300
comctl32/dsa: Handle overflow in DSA_InsertItem().
Signed-off-by: Xiaoshan Sun <sunxs at is.iscas.ac.cn>
Signed-off-by: Nikolay Sivov <nsivov at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
(cherry picked from commit 0d57ff3d1f63f7486733f8619f3916867ebd26c5)
Signed-off-by: Michael Stefaniuc <mstefani at winehq.org>
---
dlls/comctl32/dsa.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/dlls/comctl32/dsa.c b/dlls/comctl32/dsa.c
index a73a54a..d5e8234 100644
--- a/dlls/comctl32/dsa.c
+++ b/dlls/comctl32/dsa.c
@@ -267,6 +267,9 @@ INT WINAPI DSA_InsertItem (HDSA hdsa, INT nIndex, LPVOID pSrc)
nNewItems = hdsa->nMaxCount + hdsa->nGrow;
nSize = hdsa->nItemSize * nNewItems;
+ if (nSize / hdsa->nItemSize != nNewItems)
+ return -1;
+
lpTemp = ReAlloc (hdsa->pData, nSize);
if (!lpTemp)
return -1;
More information about the wine-cvs
mailing list