Zebediah Figura : msi: Fix a buffer overrun.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 39b841d18920ab3a31f3176ec0327f8643023343
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=39b841d18920ab3a31f3176ec0...

Author: Zebediah Figura 
Date:   Thu Jun 29 00:09:50 2017 -0500

msi: Fix a buffer overrun.

Signed-off-by: Zebediah Figura 
Signed-off-by: Hans Leidekker 
Signed-off-by: Alexandre Julliard

---

dlls/msi/package.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/msi/package.c b/dlls/msi/package.c
index bf6ae10..3a75a1c 100644
--- a/dlls/msi/package.c
+++ b/dlls/msi/package.c
@@ -1812,17 +1812,17 @@ INT MSI_ProcessMessage( MSIPACKAGE *package, INSTALLMESSAGE eMessageType, MSIREC
     {
         WCHAR template_s[1024];
         WCHAR *template_rec, *template;
-        DWORD length;

LoadStringW(msi_hInstance, IDS_INFO, template_s, 1024);

-        res = MSI_RecordGetStringW(record, 0, NULL, &length);
+        res = MSI_RecordGetStringW(record, 0, NULL, &len);
         if (res != ERROR_SUCCESS && res != ERROR_MORE_DATA)
             return res;
         len++;
         template_rec = msi_alloc(len * sizeof(WCHAR));
         if (!template_rec) return ERROR_OUTOFMEMORY;
-        MSI_RecordGetStringW(record, 0, template_rec, &length);
+        MSI_RecordGetStringW(record, 0, template_rec, &len);
+        len++;

template = msi_alloc((len + strlenW(template_s)) * sizeof(WCHAR));
         if (!template) return ERROR_OUTOFMEMORY;