Andrew Eikum : ole32: Don' t read past the end of the stream when converting block types.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: a0aaa65507c4f6cc1bd15f31c6e1b54ef83d7f0e
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=a0aaa65507c4f6cc1bd15f31c6...

Author: Andrew Eikum 
Date:   Fri Aug 21 14:33:40 2009 -0500

ole32: Don't read past the end of the stream when converting block types.

---

dlls/ole32/storage32.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/dlls/ole32/storage32.c b/dlls/ole32/storage32.c
index 4a27317..b06578b 100644
--- a/dlls/ole32/storage32.c
+++ b/dlls/ole32/storage32.c
@@ -3563,7 +3563,7 @@ BlockChainStream* Storage32Impl_SmallBlocksToBigBlocks(
   {
     resRead = SmallBlockChainStream_ReadAt(*ppsbChain,
                                            offset,
-                                           This->smallBlockSize,
+                                           min(This->smallBlockSize, size.u.LowPart - offset.u.LowPart),
                                            buffer,
                                            &cbRead);
     if (FAILED(resRead))
@@ -3582,7 +3582,7 @@ BlockChainStream* Storage32Impl_SmallBlocksToBigBlocks(
         if (FAILED(resWrite))
             break;

-        offset.u.LowPart += This->smallBlockSize;
+        offset.u.LowPart += cbRead;
     }
   } while (cbTotalRead.QuadPart < size.QuadPart);
   HeapFree(GetProcessHeap(),0,buffer);
@@ -3663,7 +3663,8 @@ SmallBlockChainStream* Storage32Impl_BigBlocksToSmallBlocks(
     do
     {
         resRead = BlockChainStream_ReadAt(*ppbbChain, offset,
-                This->bigBlockSize, buffer, &cbRead);
+                min(This->bigBlockSize, size.u.LowPart - offset.u.LowPart),
+                buffer, &cbRead);

if(FAILED(resRead))
             break;
@@ -3678,7 +3679,7 @@ SmallBlockChainStream* Storage32Impl_BigBlocksToSmallBlocks(
             if(FAILED(resWrite))
                 break;

-            offset.u.LowPart += This->bigBlockSize;
+            offset.u.LowPart += cbRead;
         }
     }while(cbTotalRead.QuadPart < size.QuadPart);
     HeapFree(GetProcessHeap(), 0, buffer);