Andrew Talbot wrote:
diff --git a/dlls/dmband/band.c b/dlls/dmband/band.c index 891fb5a..8b89573 100644 --- a/dlls/dmband/band.c +++ b/dlls/dmband/band.c @@ -173,7 +173,7 @@ static HRESULT WINAPI IDirectMusicBandImpl_IDirectMusicObject_SetDescriptor (LPD This->pDesc->ftDate = pDesc->ftDate; if (pDesc->dwValidData & DMUS_OBJ_MEMORY) { This->pDesc->llMemLength = pDesc->llMemLength;
memcpy (This->pDesc->pbMemData, pDesc->pbMemData, sizeof (pDesc->pbMemData));
} if (pDesc->dwValidData & DMUS_OBJ_STREAM) { /* according to MSDN, we copy the stream */memcpy (&This->pDesc->pbMemData, &pDesc->pbMemData, sizeof (pDesc->pbMemData));
This isn't correct. Judging by the surrounding code, this should be allocating a block of memory of This->pDesc->pbMemData and then passing pDesc->llMemLength into memcpy, possibly validating that pDesc->llMemLength isn't greater than UINT_MAX to avoid an overflow.
Robert Shearman wrote:
This isn't correct. Judging by the surrounding code, this should be allocating a block of memory of This->pDesc->pbMemData and then passing pDesc->llMemLength into memcpy, possibly validating that pDesc->llMemLength isn't greater than UINT_MAX to avoid an overflow.
Yes. I realised later that there were two possibilites: pointer copying or memory copying, so I sent an email to Alexandre, since I didn't have my normal usenet access at the time.
I was unable to figure out whether This->pDesc->pbMemData needs its own slice of memory or whether it can use that which comes with pDesc->pbMemData. I shall leave this one (and a similar one in dmcompos/chordmap.c) and sweep on with the easy fixes.
Thanks,