Daniel Lehman : msvcrt: Don't read past end of string in _strnicoll/ _wcsnicoll.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: eb37e2e482451e4e67cf7de8df5616e444d29278
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=eb37e2e482451e4e67cf7de8df5616e444d29278

Author: Daniel Lehman <dlehman at esri.com>
Date:   Fri Aug 17 18:51:29 2018 +0200

msvcrt: Don't read past end of string in _strnicoll/_wcsnicoll.

Signed-off-by: Daniel Lehman <dlehman at esri.com>
Signed-off-by: Piotr Caban <piotr at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/msvcrt/string.c | 3 ++-
 dlls/msvcrt/wcs.c    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/msvcrt/string.c b/dlls/msvcrt/string.c
index 37bc224..b58d56b 100644
--- a/dlls/msvcrt/string.c
+++ b/dlls/msvcrt/string.c
@@ -694,7 +694,8 @@ int CDECL MSVCRT__strnicoll_l( const char* str1, const char* str2, MSVCRT_size_t
     if(!locinfo->lc_handle[MSVCRT_LC_COLLATE])
         return strncasecmp(str1, str2, count);
     return CompareStringA(locinfo->lc_handle[MSVCRT_LC_COLLATE], NORM_IGNORECASE,
-            str1, count, str2, count)-CSTR_EQUAL;
+            str1, MSVCRT_strnlen(str1, count),
+            str2, MSVCRT_strnlen(str2, count))-CSTR_EQUAL;
 }
 
 /*********************************************************************
diff --git a/dlls/msvcrt/wcs.c b/dlls/msvcrt/wcs.c
index 3b22f62..c2a4474 100644
--- a/dlls/msvcrt/wcs.c
+++ b/dlls/msvcrt/wcs.c
@@ -151,7 +151,8 @@ int CDECL MSVCRT__wcsnicoll_l(const MSVCRT_wchar_t* str1, const MSVCRT_wchar_t*
     if(!locinfo->lc_handle[MSVCRT_LC_COLLATE])
         return strncmpiW(str1, str2, count);
     return CompareStringW(locinfo->lc_handle[MSVCRT_LC_COLLATE], NORM_IGNORECASE,
-			  str1, count, str2, count)-CSTR_EQUAL;
+			  str1, MSVCRT_wcsnlen(str1, count),
+                          str2, MSVCRT_wcsnlen(str2, count))-CSTR_EQUAL;
 }
 
 /*********************************************************************