Sebastian Lackner : oleaut32: Fix invalid memory access on 64-bit when warn+heap is used.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: ed16704ceab9057df726f64b50b224140e5dfeed
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=ed16704ceab9057df726f64b50...

Author: Sebastian Lackner <sebastian(a)fds-team.de>
Date:   Fri Jan 22 07:03:08 2016 +0100

oleaut32: Fix invalid memory access on 64-bit when warn+heap is used.

Signed-off-by: Sebastian Lackner <sebastian(a)fds-team.de>
Signed-off-by: Huw Davies <huw(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/oleaut32/oleaut.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/oleaut32/oleaut.c b/dlls/oleaut32/oleaut.c
index 00e6daf..93c5fd3 100644
--- a/dlls/oleaut32/oleaut.c
+++ b/dlls/oleaut32/oleaut.c
@@ -309,7 +309,7 @@ void WINAPI SysFreeString(BSTR str)
             cache_entry->cnt++;
 
             if(WARN_ON(heap)) {
-                unsigned n = bstr_alloc_size(bstr->size) / sizeof(DWORD) - 1;
+                unsigned n = (alloc_size-FIELD_OFFSET(bstr_t, u.ptr))/sizeof(DWORD);
                 for(i=0; i<n; i++)
                     bstr->u.dwptr[i] = ARENA_FREE_FILLER;
             }