Re: [PATCH v2 0/1] MR3358: msvcrt: fix out-of-bound access in create_locinfo

[Victor Hermann Chiletto (＠vitorhnn)]

Victor Hermann Chiletto (@vitorhnn) commented about dlls/msvcrt/locale.c:
> cur->str.str[i] = &cur->data[ret];
> -        ret += GetLocaleInfoA(lcid, time_data[i], &cur->data[ret], size-ret);
> +        ret += GetLocaleInfoA(lcid, time_data[i], &cur->data[ret], size-ret-sizeof(__lc_time_data));
>      }
>  #if _MSVCR_VER == 0 || _MSVCR_VER >= 100
>      for(i=0; i<ARRAY_SIZE(time_data); i++) {
>          cur->wstr.wstr[i] = (wchar_t*)&cur->data[ret];
>          ret += GetLocaleInfoEx(sname, time_data[i],
> -                (wchar_t*)&cur->data[ret], size-ret)*sizeof(wchar_t);
> +                (wchar_t*)&cur->data[ret], (size-ret-sizeof(__lc_time_data)) / sizeof(wchar_t))*sizeof(wchar_t);
>      }
>  #endif
>  #if _MSVCR_VER >= 110
>      cur->locname = (wchar_t*)&cur->data[ret];
> -    wcsncpy((wchar_t *) &cur->data[ret], sname, size-ret);
> +    wcsncpy((wchar_t *) &cur->data[ret], sname, (size-ret-sizeof(__lc_time_data)) / sizeof(wchar_t));

In retrospect, I should've used lstrcpynW instead of wcsncpy in all my patches. I'll submit a followup.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3358#note_39580