"James Hawkins" <truiken(a)gmail.com> writes:
> +
> + res = TranslateInfStringW(filenameW.Buffer, installW.Buffer,
> + translateW.Buffer, keyW.Buffer, NULL,
> + dwBufferSize, &len, NULL);
> +
> + if (res == S_OK)
> + {
> + bufferW = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
> +
> + res = TranslateInfStringW(filenameW.Buffer, installW.Buffer,
> + translateW.Buffer, keyW.Buffer, bufferW,
> + dwBufferSize, &len, NULL);
> +
> + *pdwRequiredSize = WideCharToMultiByte(CP_ACP, 0, bufferW, -1,
> + pszBuffer, dwBufferSize,
> + NULL, NULL);
> +
The buffer size and overflow handling is not correct here.
--
Alexandre Julliard
julliard(a)winehq.org