Module: wine
Branch: master
Commit: 8e08b1dd7f2b0ff6f72c5bcdf3e2f67a8c1cf448
URL: http://source.winehq.org/git/wine.git/?a=commit;h=8e08b1dd7f2b0ff6f72c5bcdf…
Author: Rob Shearman <rob(a)codeweavers.com>
Date: Mon Apr 28 10:21:33 2008 +0100
rpcrt4: Use safe_copy_from_buffer instead of direct memory copy in NdrBaseTypeUnmarshall.
This makes the code check that the buffer is big enough to read from
before copying the data from it. The safe_buffer_increment call is still
needed for the case where we point the memory to the buffer, so move the
call there.
---
dlls/rpcrt4/ndr_marshall.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c
index 25e6853..bdc5098 100644
--- a/dlls/rpcrt4/ndr_marshall.c
+++ b/dlls/rpcrt4/ndr_marshall.c
@@ -6051,15 +6051,15 @@ static unsigned char *WINAPI NdrBaseTypeUnmarshall(
{ \
*ppMemory = pStubMsg->Buffer; \
TRACE("*ppMemory: %p\n", *ppMemory); \
+ safe_buffer_increment(pStubMsg, sizeof(type)); \
} \
else \
{ \
if (fMustAlloc) \
*ppMemory = NdrAllocate(pStubMsg, sizeof(type)); \
TRACE("*ppMemory: %p\n", *ppMemory); \
- **(type **)ppMemory = *(type *)pStubMsg->Buffer; \
- } \
- safe_buffer_increment(pStubMsg, sizeof(type));
+ safe_copy_from_buffer(pStubMsg, *ppMemory, sizeof(type)); \
+ }
switch(*pFormat)
{