[PATCH] ole32: allocate more for FmtIdToPropStgName (Coverity)
Marcus Meissner
marcus at jet.franken.de
Sat Jun 18 02:58:09 CDT 2016
713214 Out-of-bounds access
713213 Out-of-bounds access
713212 Out-of-bounds access
This is tricky. The define is for 31 characters. The MSDN page for
FmtIdToPropStgName however says
"The array allocated for this string must be at least CCH_MAX_PROPSTG_NAME (32) characters in length."
I left the define as-is, as google finds only 31 values.
Signed-off-by: Marcus Meissner <marcus at jet.franken.de>
---
dlls/ole32/stg_prop.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/dlls/ole32/stg_prop.c b/dlls/ole32/stg_prop.c
index 8e1aaef..a259883 100644
--- a/dlls/ole32/stg_prop.c
+++ b/dlls/ole32/stg_prop.c
@@ -2178,7 +2178,7 @@ static HRESULT WINAPI IPropertySetStorage_fnCreate(
IPropertyStorage** ppprstg)
{
StorageImpl *This = impl_from_IPropertySetStorage(ppstg);
- WCHAR name[CCH_MAX_PROPSTG_NAME];
+ WCHAR name[CCH_MAX_PROPSTG_NAME + 1];
IStream *stm = NULL;
HRESULT r;
@@ -2236,7 +2236,7 @@ static HRESULT WINAPI IPropertySetStorage_fnOpen(
{
StorageImpl *This = impl_from_IPropertySetStorage(ppstg);
IStream *stm = NULL;
- WCHAR name[CCH_MAX_PROPSTG_NAME];
+ WCHAR name[CCH_MAX_PROPSTG_NAME + 1];
HRESULT r;
TRACE("%p %s %08x %p\n", This, debugstr_guid(rfmtid), grfMode, ppprstg);
@@ -2280,7 +2280,7 @@ static HRESULT WINAPI IPropertySetStorage_fnDelete(
REFFMTID rfmtid)
{
StorageImpl *This = impl_from_IPropertySetStorage(ppstg);
- WCHAR name[CCH_MAX_PROPSTG_NAME];
+ WCHAR name[CCH_MAX_PROPSTG_NAME + 1];
HRESULT r;
TRACE("%p %s\n", This, debugstr_guid(rfmtid));
--
2.8.4
More information about the wine-patches
mailing list