rpcrt4: Fix the buffer bounds check.

12d39054 · Dmitry Timoshkov · Alexandre Julliard · 3b1ab769 · 12d39054
Commit 12d39054 authored Jul 19, 2007 by Dmitry Timoshkov Committed by Alexandre Julliard Jul 19, 2007
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

ndr_marshall.c dlls/rpcrt4/ndr_marshall.c +1 -1

No files found.
--- a/dlls/rpcrt4/ndr_marshall.c
+++ b/dlls/rpcrt4/ndr_marshall.c
@@ -759,7 +759,7 @@ unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg

  /* verify the buffer is safe to access */
  if ((pStubMsg->Buffer + bufsize < pStubMsg->Buffer) ||
-      (pStubMsg->Buffer + bufsize < pStubMsg->BufferEnd))
+      (pStubMsg->Buffer + bufsize > pStubMsg->BufferEnd))
  {
    ERR("bufsize 0x%x exceeded buffer end %p of buffer %p\n", bufsize,
        pStubMsg->BufferEnd, pStubMsg->Buffer);