Rob Shearman : rpcrt4: Use safe_copy_from_buffer instead of direct memory copy in NdrBaseTypeUnmarshall .

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 8e08b1dd7f2b0ff6f72c5bcdf3e2f67a8c1cf448
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=8e08b1dd7f2b0ff6f72c5bcdf3...

Author: Rob Shearman 
Date:   Mon Apr 28 10:21:33 2008 +0100

rpcrt4: Use safe_copy_from_buffer instead of direct memory copy in NdrBaseTypeUnmarshall.

This makes the code check that the buffer is big enough to read from 
before copying the data from it. The safe_buffer_increment call is still 
needed for the case where we point the memory to the buffer, so move the 
call there.

---

dlls/rpcrt4/ndr_marshall.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c
index 25e6853..bdc5098 100644
--- a/dlls/rpcrt4/ndr_marshall.c
+++ b/dlls/rpcrt4/ndr_marshall.c
@@ -6051,15 +6051,15 @@ static unsigned char *WINAPI NdrBaseTypeUnmarshall(
         { \
             *ppMemory = pStubMsg->Buffer; \
             TRACE("*ppMemory: %p\n", *ppMemory); \
+            safe_buffer_increment(pStubMsg, sizeof(type)); \
         } \
         else \
         {  \
             if (fMustAlloc) \
                 *ppMemory = NdrAllocate(pStubMsg, sizeof(type)); \
             TRACE("*ppMemory: %p\n", *ppMemory); \
-            **(type **)ppMemory = *(type *)pStubMsg->Buffer; \
-        } \
-	safe_buffer_increment(pStubMsg, sizeof(type));
+            safe_copy_from_buffer(pStubMsg, *ppMemory, sizeof(type)); \
+        }

switch(*pFormat)
     {