Re: [PATCH 0/1] MR11325: winspool: Avoid overflow because the size is insufficient.

[Huw Davies (＠huw)]

Huw Davies (@huw) commented about dlls/winspool.drv/info.c:
> WCHAR  driverdir[MAX_PATH];
>      DWORD  dirlen;
>      LPBYTE strPtr = pDriverStrings;
> -    LPDRIVER_INFO_8W di = (LPDRIVER_INFO_8W) ptr;
> +    LPDRIVER_INFO_8W di = (cbBuf >= di_sizeof[Level]) ? (LPDRIVER_INFO_8W) ptr : NULL;

This doesn't look right; `cbBuf` is supposed to be the size of the string buffer, not the entire memory block.  The caller should have already subtracted the size of the appropriate structure.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11325#note_148910