Piotr Caban : msvcrt: Limit access to out buffer in fread function.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 027d9852105d515196f7c6271d76b8c5316e47cd
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=027d9852105d515196f7c6271d...

Author: Piotr Caban 
Date:   Thu Mar 14 13:13:44 2013 +0100

msvcrt: Limit access to out buffer in fread function.

DVDFab HD Decrypter expects that unused part of output buffer is not
modified.

---

dlls/msvcrt/file.c |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/dlls/msvcrt/file.c b/dlls/msvcrt/file.c
index 4561711..28aefc1 100644
--- a/dlls/msvcrt/file.c
+++ b/dlls/msvcrt/file.c
@@ -35,6 +35,7 @@
 # include <unistd.h>
 #endif
 #include <sys/types.h>
+#include <limits.h>

#include "windef.h"
 #include "winbase.h"
@@ -3652,10 +3653,7 @@ MSVCRT_size_t CDECL MSVCRT_fread(void *ptr, MSVCRT_size_t size, MSVCRT_size_t nm
   while(rcnt>0)
   {
     int i;
-    /* Fill the buffer on small reads.
-     * TODO: Use a better buffering strategy.
-     */
-    if (!file->_cnt && size*nmemb <= MSVCRT_BUFSIZ/2 && !(file->_flag & MSVCRT__IONBF)
+    if (!file->_cnt && rcnt<MSVCRT_BUFSIZ && !(file->_flag & MSVCRT__IONBF)
             && (file->_bufsiz != 0 || msvcrt_alloc_buffer(file))) {
       file->_cnt = MSVCRT__read(file->_file, file->_base, file->_bufsiz);
       file->_ptr = file->_base;
@@ -3670,8 +3668,12 @@ MSVCRT_size_t CDECL MSVCRT_fread(void *ptr, MSVCRT_size_t size, MSVCRT_size_t nm
         file->_cnt -= i;
         file->_ptr += i;
       }
+    } else if (rcnt > UINT_MAX) {
+      i = MSVCRT__read(file->_file, ptr, UINT_MAX);
+    } else if (rcnt < MSVCRT_BUFSIZ) {
+      i = MSVCRT__read(file->_file, ptr, rcnt);
     } else {
-      i = MSVCRT__read(file->_file,ptr, rcnt);
+      i = MSVCRT__read(file->_file, ptr, rcnt - MSVCRT_BUFSIZ/2);
     }
     pread += i;
     rcnt -= i;