Piotr Caban : msvcrt: Fix buffer overflow in _write function.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 427e2bb60995300d479fba602362a24147d76a2c
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=427e2bb60995300d479fba602...

Author: Piotr Caban <piotr(a)codeweavers.com>
Date:   Tue Sep 15 11:55:37 2020 +0200

msvcrt: Fix buffer overflow in _write function.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=49770
Signed-off-by: Piotr Caban <piotr(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/msvcrt/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/msvcrt/file.c b/dlls/msvcrt/file.c
index a37aa87b5d..602fe6d1df 100644
--- a/dlls/msvcrt/file.c
+++ b/dlls/msvcrt/file.c
@@ -3504,7 +3504,8 @@ int CDECL MSVCRT__write(int fd, const void* buf, unsigned int count)
             }
 #endif
 
-            for (;  i < count && j < sizeof(conv)-1; i++, j++, len++)
+            for (; i < count && j < sizeof(conv)-1 &&
+                    len < (sizeof(lfbuf) - 1) / sizeof(WCHAR); i++, j++, len++)
             {
                 if (MSVCRT_isleadbyte((unsigned char)s[i]))
                 {