Daniel Lehman : kernelbase: Pass va_list copy to internal RtlFormatMessage.

[Alexandre Julliard]

Module: wine
Branch: oldstable
Commit: 66484ed229bc75c12e0aaba02f5c0348aee70286
URL:    https://gitlab.winehq.org/wine/wine/-/commit/66484ed229bc75c12e0aaba02f5c034...

Author: Daniel Lehman 
Date:   Sat Jun  4 08:03:02 2022 -0700

kernelbase: Pass va_list copy to internal RtlFormatMessage.

va_list passed to RtlFormatMessage is modified even on error in this
case, if the buffer is not large enough, STATUS_BUFFER_OVERFLOW is
returned and FormatMessage tries again, but the va_list pointer is now
moved to a later argument, so the next call reads off the end,
crashing.

Signed-off-by: Daniel Lehman 
Signed-off-by: Alexandre Julliard 
(cherry picked from commit 1714963a5f9e62deb7aaa8f751640cbf87d57993)
Signed-off-by: Michael Stefaniuc

---

dlls/kernelbase/locale.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/dlls/kernelbase/locale.c b/dlls/kernelbase/locale.c
index 667d1a4dc65..0f6904f2ffe 100644
--- a/dlls/kernelbase/locale.c
+++ b/dlls/kernelbase/locale.c
@@ -3835,6 +3835,7 @@ DWORD WINAPI DECLSPEC_HOTPATCH FormatMessageW( DWORD flags, const void *source,
     if (flags & FORMAT_MESSAGE_ALLOCATE_BUFFER)
     {
         WCHAR *result;
+        va_list args_copy;
         ULONG alloc = max( size * sizeof(WCHAR), 65536 );

for (;;)
@@ -3844,9 +3845,17 @@ DWORD WINAPI DECLSPEC_HOTPATCH FormatMessageW( DWORD flags, const void *source,
                 status = STATUS_NO_MEMORY;
                 break;
             }
-            status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
-                                       FALSE, !!(flags & FORMAT_MESSAGE_ARGUMENT_ARRAY), args,
-                                       result, alloc, &retsize );
+            if (args && !(flags & FORMAT_MESSAGE_ARGUMENT_ARRAY))
+            {
+                va_copy( args_copy, *args );
+                status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
+                                           FALSE, FALSE, &args_copy, result, alloc, &retsize );
+                va_end( args_copy );
+            }
+            else
+                status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
+                                           FALSE, TRUE, args, result, alloc, &retsize );
+
             if (!status)
             {
                 if (retsize <= sizeof(WCHAR)) HeapFree( GetProcessHeap(), 0, result );