marko10_000
/
wine-wine
forked from Mirrors/wine-wine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

winevdm: Fix incorrect heap allocation sizes and possible out-of-bounds access in find_dosbox helper.

oldstable
Andrew Nguyen 2011-04-16 03:25:15 -05:00 committed by Alexandre Julliard
parent 281f86eae4
commit 3474e3da22
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
programs/winevdm/winevdm.c
View File

@ -114,11 +114,15 @@ static char *find_dosbox(void)
const char *envpath = getenv( "PATH" );
struct stat st;
char *path, *p, *buffer, *dir;
size_t envpath_len;
if (!envpath) return NULL;
path = HeapAlloc( GetProcessHeap(), 0, strlen(envpath) );
buffer = HeapAlloc( GetProcessHeap(), 0, strlen(path) + sizeof("/dosbox") );
envpath_len = strlen( envpath );
path = HeapAlloc( GetProcessHeap(), 0, envpath_len + 1 );
buffer = HeapAlloc( GetProcessHeap(), 0, envpath_len + sizeof("/dosbox") );
strcpy( path, envpath );
p = path;
while (*p)
{
@ -126,7 +130,7 @@ static char *find_dosbox(void)
if (!*p) break;
dir = p;
while (*p && *p != ':') p++;
*p++ = 0;
if (*p == ':') *p++ = 0;
strcpy( buffer, dir );
strcat( buffer, "/dosbox" );
if (!stat( buffer, &st ))