Rob Shearman : rpcrt4: Fix NdrConformantStringUnmarshall to always increment the buffer during unmarshalling .

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 9a888e6465b79b5c3daec2723987aec3120888a6
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=9a888e6465b79b5c3daec27239...

Author: Rob Shearman 
Date:   Thu Dec 20 09:51:47 2007 +0000

rpcrt4: Fix NdrConformantStringUnmarshall to always increment the buffer during unmarshalling.

safe_copy_from_buffer has the side-effect of incrementing the buffer and 
this still needs to be done when we point the memory into the buffer.

(Thanks to Maarten Lankhorst for finding the mistake and suggesting a fix.)

---

dlls/rpcrt4/ndr_marshall.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c
index 0167bcf..2322c78 100644
--- a/dlls/rpcrt4/ndr_marshall.c
+++ b/dlls/rpcrt4/ndr_marshall.c
@@ -890,7 +890,9 @@ unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg
       *ppMemory = NdrAllocate(pStubMsg, memsize);
   }

-  if (*ppMemory != pStubMsg->Buffer)
+  if (*ppMemory == pStubMsg->Buffer)
+    safe_buffer_increment(pStubMsg, bufsize);
+  else
     safe_copy_from_buffer(pStubMsg, *ppMemory, bufsize);

if (*pFormat == RPC_FC_C_CSTRING) {