Piotr Caban : msi: Fix use after free error in TransformView_set_row.
Alexandre Julliard
julliard at winehq.org
Thu Jul 2 15:04:31 CDT 2020
Module: wine
Branch: master
Commit: 6a0a0d2a0b15bffa9d4a5b41e75be6765e731d69
URL: https://source.winehq.org/git/wine.git/?a=commit;h=6a0a0d2a0b15bffa9d4a5b41e75be6765e731d69
Author: Piotr Caban <piotr at codeweavers.com>
Date: Wed Jul 1 10:43:00 2020 +0200
msi: Fix use after free error in TransformView_set_row.
Signed-off-by: Piotr Caban <piotr at codeweavers.com>
Signed-off-by: Hans Leidekker <hans at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/msi/table.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/dlls/msi/table.c b/dlls/msi/table.c
index d4912ab3ae..3febcb3aa9 100644
--- a/dlls/msi/table.c
+++ b/dlls/msi/table.c
@@ -2341,7 +2341,7 @@ static UINT TransformView_set_row( MSIVIEW *view, UINT row, MSIRECORD *rec, UINT
L"INSERT INTO `_TransformView` (`Table`, `Column`, `Row`, `Data`, `Current`) VALUES ('";
MSITABLEVIEW *tv = (MSITABLEVIEW*)view;
- WCHAR buf[256], *query = buf;
+ WCHAR buf[256], *query;
MSIRECORD *old_rec;
MSIQUERY *q;
WCHAR *key;
@@ -2409,6 +2409,10 @@ static UINT TransformView_set_row( MSIVIEW *view, UINT row, MSIRECORD *rec, UINT
return ERROR_OUTOFMEMORY;
}
}
+ else
+ {
+ query = buf;
+ }
memcpy( query, query_pfx, p * sizeof(WCHAR) );
len = wcslen( tv->name );
More information about the wine-cvs
mailing list