[PATCH 1/1] ntdll: Fix a memory overflow.

[chy]

From: chy

---
 dlls/ntdll/tests/string.c | 19 +++++++++++++++++++
 dlls/ntdll/wcstring.c     |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/tests/string.c b/dlls/ntdll/tests/string.c
index 787756daf14..b923c797030 100644
--- a/dlls/ntdll/tests/string.c
+++ b/dlls/ntdll/tests/string.c
@@ -68,6 +68,7 @@ static WCHAR    (__cdecl *ptowlower)(WCHAR);
 static WCHAR    (__cdecl *ptowupper)(WCHAR);
 static int      (__cdecl *p_wcsicmp)(LPCWSTR,LPCWSTR);
 static int      (__cdecl *p_wcsnicmp)(LPCWSTR,LPCWSTR,int);
+static LPWSTR   (__cdecl *pwcsncpy)(LPCWSTR,LPCWSTR,int);

static LPWSTR   (__cdecl *pwcschr)(LPCWSTR, WCHAR);
 static LPWSTR   (__cdecl *pwcsrchr)(LPCWSTR, WCHAR);
@@ -139,6 +140,7 @@ static void InitFunctionPtrs(void)
     X(towupper);
     X(_wcsicmp);
     X(_wcsnicmp);
+    X(wcsncpy);
     X(wcschr);
     X(wcsrchr);
     X(memchr);
@@ -2233,6 +2235,22 @@ static void test_memchr(void)
     ok(r == s, "memchr returned %p, expected %p\n", r, s);
 }

+static void test_wcsncpy(void)
+{
+    wchar_t dst[6], *p;
+
+    memset(dst, 0xff, sizeof(dst));
+    p = pwcsncpy(dst, L"1234567", 6);
+    ok(p == dst, "unexpected return value.\n");
+    ok(!memcmp(dst, L"123456", sizeof(dst)), "unexpected buffer %s\n",
+            wine_dbgstr_wn(dst, ARRAY_SIZE(dst)));
+
+    memset(dst, 0xbb, sizeof(dst));
+    pwcsncpy(dst, L"123", 5);
+    ok(dst[4] == 0, "expected 0, unexpected wchar_t %x\n", dst[4]);
+    ok(dst[5] == 0xbbbb , "expected 0xbbbb unexpected wchar_t %x\n", dst[5]);
+}
+
 START_TEST(string)
 {
     InitFunctionPtrs();
@@ -2266,4 +2284,5 @@ START_TEST(string)
     test_wctype();
     test_ctype();
     test_memchr();
+    test_wcsncpy();
 }
diff --git a/dlls/ntdll/wcstring.c b/dlls/ntdll/wcstring.c
index aa43c3de16b..18ddc5b4f1a 100644
--- a/dlls/ntdll/wcstring.c
+++ b/dlls/ntdll/wcstring.c
@@ -354,7 +354,7 @@ LPWSTR __cdecl wcsncpy( LPWSTR s1, LPCWSTR s2, size_t n )
 {
     WCHAR *ret = s1;
     for ( ; n; n--) if (!(*s1++ = *s2++)) break;
-    for ( ; n; n--) *s1++ = 0;
+    for ( ; n > 1; n--) *s1++ = 0;
     return ret;
 }