Alex Villacís Lasso : winealsa: Ensure that copy_format() will not write past end of

[Alexandre Julliard]

Module: wine
Branch: refs/heads/master
Commit: 6d88d5ad5cd79d0cc6ee3ddfd4d86f09d9e890f1
URL:    http://source.winehq.org/git/?p=wine.git;a=commit;h=6d88d5ad5cd79d0cc6ee3ddf...

Author: Alex Villacís Lasso 
Date:   Wed Jan 11 12:33:05 2006 +0100

winealsa: Ensure that copy_format() will not write past end of
referenced WAVEFORMATPCMEX structure.

---

dlls/winmm/winealsa/audio.c |   13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/dlls/winmm/winealsa/audio.c b/dlls/winmm/winealsa/audio.c
index a64d70e..7beab7b 100644
--- a/dlls/winmm/winealsa/audio.c
+++ b/dlls/winmm/winealsa/audio.c
@@ -404,13 +404,20 @@ static BOOL supportedFormat(LPWAVEFORMAT

static void copy_format(LPWAVEFORMATEX wf1, LPWAVEFORMATPCMEX wf2)
 {
+    unsigned int iLength;        
+
     ZeroMemory(wf2, sizeof(wf2));
     if (wf1->wFormatTag == WAVE_FORMAT_PCM)
-        memcpy(wf2, wf1, sizeof(PCMWAVEFORMAT));
+        iLength = sizeof(PCMWAVEFORMAT);
     else if (wf1->wFormatTag == WAVE_FORMAT_EXTENSIBLE)
-        memcpy(wf2, wf1, sizeof(WAVEFORMATPCMEX));
+        iLength = sizeof(WAVEFORMATPCMEX);
     else
-        memcpy(wf2, wf1, sizeof(WAVEFORMATEX) + wf1->cbSize);
+        iLength = sizeof(WAVEFORMATEX) + wf1->cbSize;
+    if (iLength > sizeof(WAVEFORMATPCMEX)) {
+        ERR("calculated %u bytes, capping to %u bytes\n", iLength, sizeof(WAVEFORMATPCMEX));
+        iLength = sizeof(WAVEFORMATPCMEX);
+    }
+    memcpy(wf2, wf1, iLength);
 }

/*----------------------------------------------------------------------------