Gijs Vermeulen : ntoskrnl.exe/tests: Avoid passing uninitialized data to DeviceIoControl().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: db8f599863b2158fe854b3d937db8257c660bab5
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=db8f599863b2158fe854b3d937db8257c660bab5

Author: Gijs Vermeulen <gijsvrm at gmail.com>
Date:   Thu Jan 10 07:11:15 2019 +0100

ntoskrnl.exe/tests: Avoid passing uninitialized data to DeviceIoControl().

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=46346
Signed-off-by: Gijs Vermeulen <gijsvrm at gmail.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/ntoskrnl.exe/tests/ntoskrnl.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dlls/ntoskrnl.exe/tests/ntoskrnl.c b/dlls/ntoskrnl.exe/tests/ntoskrnl.c
index 5675818..9ab05bc 100644
--- a/dlls/ntoskrnl.exe/tests/ntoskrnl.c
+++ b/dlls/ntoskrnl.exe/tests/ntoskrnl.c
@@ -155,12 +155,13 @@ static void main_test(void)
     GetTempFileNameW(temppathW, dokW, 0, pathW);
     pRtlDosPathNameToNtPathName_U( pathW, &pathU, NULL, NULL );
 
-    test_input = heap_alloc(sizeof(*test_input) + pathU.Length);
+    test_input = heap_alloc( offsetof( struct test_input, path[pathU.Length / sizeof(WCHAR)]) );
     test_input->running_under_wine = !strcmp(winetest_platform, "wine");
     test_input->winetest_report_success = winetest_report_success;
     test_input->winetest_debug = winetest_debug;
-    lstrcpynW(test_input->path, pathU.Buffer, pathU.Length);
-    res = DeviceIoControl(device, IOCTL_WINETEST_MAIN_TEST, test_input, sizeof(*test_input) + pathU.Length,
+    memcpy(test_input->path, pathU.Buffer, pathU.Length + sizeof(WCHAR));
+    res = DeviceIoControl(device, IOCTL_WINETEST_MAIN_TEST, test_input,
+                          offsetof( struct test_input, path[pathU.Length / sizeof(WCHAR)]),
                           &new_failures, sizeof(new_failures), &written, NULL);
     ok(res, "DeviceIoControl failed: %u\n", GetLastError());
     ok(written == sizeof(new_failures), "got size %x\n", written);