Juan Lang : crypt32: Don' t copy past end of buffer when removing a string from a multi string.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f2040b772544ebc434fa82a27713aa3a248c1b45
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=f2040b772544ebc434fa82a277...

Author: Juan Lang <juan.lang(a)gmail.com>
Date:   Sun Nov 29 11:42:57 2009 -0800

crypt32: Don't copy past end of buffer when removing a string from a multi string.

---

 dlls/crypt32/oid.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/crypt32/oid.c b/dlls/crypt32/oid.c
index 0a3889d..68a4852 100644
--- a/dlls/crypt32/oid.c
+++ b/dlls/crypt32/oid.c
@@ -881,9 +881,11 @@ static BOOL CRYPT_RemoveStringFromMultiString(LPWSTR multi, LPCWSTR toRemove)
         }
         else
         {
+            LPCWSTR nextStr = spotToRemove + lstrlenW(toRemove) + 1;
+
             /* Copy remainder of string "left" */
-            memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
-             (len - (spotToRemove - multi)) * sizeof(WCHAR));
+            memmove(spotToRemove, nextStr,
+             (len - (nextStr - multi)) * sizeof(WCHAR));
         }
         ret = TRUE;
     }