marko10_000
/
wine-wine
forked from Mirrors/wine-wine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

msi: Prevent array underflow in MsiFormat when measuring with zero-length buffer.

oldstable
Bill Medland 2005-12-21 21:19:47 +01:00 committed by Alexandre Julliard
parent bad4a1dc5f
commit b56ed22277
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dlls/msi/format.c
View File

@ -639,10 +639,15 @@ UINT MSI_FormatRecordA( MSIPACKAGE* package, MSIRECORD* record, LPSTR buffer,
len = deformat_string_internal(package,rec,&deformated,strlenW(rec), len = deformat_string_internal(package,rec,&deformated,strlenW(rec),
record, NULL); record, NULL);
/* If len is zero then WideCharToMultiByte will return 0 indicating
* failure, but that will do just as well since we are ignoring
* possible errors.
*/
lenA = WideCharToMultiByte(CP_ACP,0,deformated,len,NULL,0,NULL,NULL); lenA = WideCharToMultiByte(CP_ACP,0,deformated,len,NULL,0,NULL,NULL);
if (buffer) if (buffer)
{ {
/* Ditto above */
WideCharToMultiByte(CP_ACP,0,deformated,len,buffer,*size,NULL, NULL); WideCharToMultiByte(CP_ACP,0,deformated,len,buffer,*size,NULL, NULL);
if (*size>lenA) if (*size>lenA)
{ {
@ -652,7 +657,8 @@ UINT MSI_FormatRecordA( MSIPACKAGE* package, MSIRECORD* record, LPSTR buffer,
else else
{ {
rc = ERROR_MORE_DATA; rc = ERROR_MORE_DATA;
buffer[(*size)-1] = 0; if (*size)
buffer[(*size)-1] = 0;
} }
} }
else else

7
dlls/msi/tests/format.c
View File

@ -109,7 +109,7 @@ static void test_formatrecord(void)
char buffer[100]; char buffer[100];
MSIHANDLE hrec; MSIHANDLE hrec;
UINT r; UINT r;
DWORD sz=100; DWORD sz;
r = MsiFormatRecord(0, 0, NULL, NULL ); r = MsiFormatRecord(0, 0, NULL, NULL );
ok( r == ERROR_INVALID_HANDLE, "wrong error\n"); ok( r == ERROR_INVALID_HANDLE, "wrong error\n");
@ -122,6 +122,11 @@ static void test_formatrecord(void)
ok( r == ERROR_SUCCESS, "format failed\n"); ok( r == ERROR_SUCCESS, "format failed\n");
buffer[0] = 'x'; buffer[0] = 'x';
buffer[1] = 0; buffer[1] = 0;
sz=0;
r = MsiFormatRecord(0, hrec, buffer+1, &sz);
ok( r == ERROR_MORE_DATA && buffer[0] == 'x', "format failed measuring with buffer\n");
ok( sz == 16, "size wrong\n");
sz=100;
r = MsiFormatRecord(0, hrec, buffer, &sz); r = MsiFormatRecord(0, hrec, buffer, &sz);
ok( r == ERROR_SUCCESS, "format failed with empty buffer\n"); ok( r == ERROR_SUCCESS, "format failed with empty buffer\n");
ok( sz == 16, "size wrong\n"); ok( sz == 16, "size wrong\n");