[1/4] msadp32.acm: Ensure we have enough memory before memcopying data

Bruno Jesus 00cpxxx at gmail.com
Tue Sep 8 23:10:21 CDT 2015


While writing a test for acmFormatSuggest I noticed that wine changes
the source format pointer aside from the destination format resulting
in crashes. It happens because ADPCM_FormatSuggest does not check if
it has enough bytes to write the ADPCM stuff in the destination
format. This patch makes my tests (patch 3) run cleanly.
-------------- next part --------------

---
 dlls/msadp32.acm/msadp32.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dlls/msadp32.acm/msadp32.c b/dlls/msadp32.acm/msadp32.c
index 83d1b46..2c61575 100644
--- a/dlls/msadp32.acm/msadp32.c
+++ b/dlls/msadp32.acm/msadp32.c
@@ -542,6 +542,8 @@ static	LRESULT	ADPCM_FormatSuggest(PACMDRVFORMATSUGGEST adfs)
         if (ADPCM_GetFormatIndex(adfs->pwfxDst) == 0xFFFFFFFF) return ACMERR_NOTPOSSIBLE;
         break;
     case WAVE_FORMAT_ADPCM:
+        if (adfs->cbwfxDst < sizeof(ADPCMWAVEFORMAT) + (7 - 1) * sizeof(ADPCMCOEFSET))
+            return ACMERR_NOTPOSSIBLE;
         init_wfx_adpcm((ADPCMWAVEFORMAT*)adfs->pwfxDst);
         /* check if result is ok */
         if (ADPCM_GetFormatIndex(adfs->pwfxDst) == 0xFFFFFFFF) return ACMERR_NOTPOSSIBLE;
-- 
2.1.4



More information about the wine-patches mailing list