Juan Lang : crypt32: Don' t copy past end of buffer when removing the last string in a multistring.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 88e599c4cf118d323b4566e7f456dcaf5ba309be
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=88e599c4cf118d323b4566e7f4...

Author: Juan Lang 
Date:   Wed Nov  4 16:29:33 2009 -0800

crypt32: Don't copy past end of buffer when removing the last string in a multistring.

---

dlls/crypt32/oid.c |   15 ++++++++++++---
 1 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/dlls/crypt32/oid.c b/dlls/crypt32/oid.c
index ddc6efc..0a3889d 100644
--- a/dlls/crypt32/oid.c
+++ b/dlls/crypt32/oid.c
@@ -873,9 +873,18 @@ static BOOL CRYPT_RemoveStringFromMultiString(LPWSTR multi, LPCWSTR toRemove)
     {
         DWORD len = CRYPT_GetMultiStringCharacterLen(multi);

-        /* Copy remainder of string "left" */
-        memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
-         (len - (spotToRemove - multi)) * sizeof(WCHAR));
+        if (spotToRemove + lstrlenW(toRemove) + 2 >= multi + len)
+        {
+            /* Removing last string in list, terminate multi string directly */
+            *spotToRemove = 0;
+            *(spotToRemove + 1) = 0;
+        }
+        else
+        {
+            /* Copy remainder of string "left" */
+            memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
+             (len - (spotToRemove - multi)) * sizeof(WCHAR));
+        }
         ret = TRUE;
     }
     else