Aric Stewart : user: Correct buffer overflows in IME processing code.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 5537fbbcfffcf00c590017dd645049b97ca657fc
URL:    http://source.winehq.org/git/?p=wine.git;a=commit;h=5537fbbcfffcf00c590017dd...

Author: Aric Stewart <aric(a)codeweavers.com>
Date:   Thu Sep 21 09:43:00 2006 -0500

user: Correct buffer overflows in IME processing code.

---

 dlls/user/edit.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/user/edit.c b/dlls/user/edit.c
index c4f95e4..116340f 100644
--- a/dlls/user/edit.c
+++ b/dlls/user/edit.c
@@ -5341,7 +5341,7 @@ static void EDIT_GetCompositionStr(HWND 
         return;
     }
 
-    lpCompStr = HeapAlloc(GetProcessHeap(),0,dwBufLen);
+    lpCompStr = HeapAlloc(GetProcessHeap(),0,dwBufLen + sizeof(WCHAR));
     if (!lpCompStr)
     {
         ERR("Unable to allocate IME CompositionString\n");
@@ -5362,7 +5362,7 @@ static void EDIT_GetCompositionStr(HWND 
         if (dwBufLenAttr)
         {
             dwBufLenAttr ++;
-            lpCompStrAttr = HeapAlloc(GetProcessHeap(),0,dwBufLenAttr);
+            lpCompStrAttr = HeapAlloc(GetProcessHeap(),0,dwBufLenAttr+1);
             if (!lpCompStrAttr)
             {
                 ERR("Unable to allocate IME Attribute String\n");
@@ -5417,7 +5417,7 @@ static void EDIT_GetResultStr(HWND hwnd,
         return;
     }
 
-    lpResultStr = HeapAlloc(GetProcessHeap(),0, dwBufLen);
+    lpResultStr = HeapAlloc(GetProcessHeap(),0, dwBufLen+sizeof(WCHAR));
     if (!lpResultStr)
     {
         ERR("Unable to alloc buffer for IME string\n");