[PATCH v2 1/1] msvcrt: fix out-of-bound access in create_locinfo

[Yuxuan Shui]

From: Yuxuan Shui

Fixes: 24a2b625545f1875b5c3177f2b9
Signed-off-by: Yuxuan Shui 
---
 dlls/msvcrt/locale.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/msvcrt/locale.c b/dlls/msvcrt/locale.c
index 9fa6ba76143..b82e5dec990 100644
--- a/dlls/msvcrt/locale.c
+++ b/dlls/msvcrt/locale.c
@@ -1251,18 +1251,18 @@ static __lc_time_data* create_time_data(WCHAR *sname)
     ret = 0;
     for(i=0; i<ARRAY_SIZE(time_data); i++) {
         cur->str.str[i] = &cur->data[ret];
-        ret += GetLocaleInfoA(lcid, time_data[i], &cur->data[ret], size-ret);
+        ret += GetLocaleInfoA(lcid, time_data[i], &cur->data[ret], size-ret-sizeof(__lc_time_data));
     }
 #if _MSVCR_VER == 0 || _MSVCR_VER >= 100
     for(i=0; i<ARRAY_SIZE(time_data); i++) {
         cur->wstr.wstr[i] = (wchar_t*)&cur->data[ret];
         ret += GetLocaleInfoEx(sname, time_data[i],
-                (wchar_t*)&cur->data[ret], size-ret)*sizeof(wchar_t);
+                (wchar_t*)&cur->data[ret], (size-ret-sizeof(__lc_time_data)) / sizeof(wchar_t))*sizeof(wchar_t);
     }
 #endif
 #if _MSVCR_VER >= 110
     cur->locname = (wchar_t*)&cur->data[ret];
-    wcsncpy((wchar_t *) &cur->data[ret], sname, size-ret);
+    wcsncpy((wchar_t *) &cur->data[ret], sname, (size-ret-sizeof(__lc_time_data)) / sizeof(wchar_t));
 #else
     cur->lcid = lcid;
 #endif