Module: wine Branch: master Commit: 39b841d18920ab3a31f3176ec0327f8643023343 URL: http://source.winehq.org/git/wine.git/?a=commit;h=39b841d18920ab3a31f3176ec0...
Author: Zebediah Figura z.figura12@gmail.com Date: Thu Jun 29 00:09:50 2017 -0500
msi: Fix a buffer overrun.
Signed-off-by: Zebediah Figura z.figura12@gmail.com Signed-off-by: Hans Leidekker hans@codeweavers.com Signed-off-by: Alexandre Julliard julliard@winehq.org
---
dlls/msi/package.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/dlls/msi/package.c b/dlls/msi/package.c index bf6ae10..3a75a1c 100644 --- a/dlls/msi/package.c +++ b/dlls/msi/package.c @@ -1812,17 +1812,17 @@ INT MSI_ProcessMessage( MSIPACKAGE *package, INSTALLMESSAGE eMessageType, MSIREC { WCHAR template_s[1024]; WCHAR *template_rec, *template; - DWORD length;
LoadStringW(msi_hInstance, IDS_INFO, template_s, 1024);
- res = MSI_RecordGetStringW(record, 0, NULL, &length); + res = MSI_RecordGetStringW(record, 0, NULL, &len); if (res != ERROR_SUCCESS && res != ERROR_MORE_DATA) return res; len++; template_rec = msi_alloc(len * sizeof(WCHAR)); if (!template_rec) return ERROR_OUTOFMEMORY; - MSI_RecordGetStringW(record, 0, template_rec, &length); + MSI_RecordGetStringW(record, 0, template_rec, &len); + len++;
template = msi_alloc((len + strlenW(template_s)) * sizeof(WCHAR)); if (!template) return ERROR_OUTOFMEMORY;