kernelbase: Pass va_list copy to internal RtlFormatMessage.

va_list passed to RtlFormatMessage is modified even on error in this case, if the buffer is not large enough, STATUS_BUFFER_OVERFLOW is returned and FormatMessage tries again, but the va_list pointer is now moved to a later argument, so the next call reads off the end, crashing. Signed-off-by: Daniel Lehman <dlehman25@gmail.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

kernelbase: Pass va_list copy to internal RtlFormatMessage.
1714963a · Daniel Lehman · Alexandre Julliard · 8986f6fa · 1714963a
Commit 1714963a authored Jun 04, 2022 by Daniel Lehman Committed by Alexandre Julliard Jun 13, 2022
Show whitespace changes
Inline Side-by-side

Showing with 11 additions and 2 deletions

locale.c dlls/kernelbase/locale.c +11 -2

No files found.
--- a/dlls/kernelbase/locale.c
+++ b/dlls/kernelbase/locale.c
@@ -5457,6 +5457,7 @@ DWORD WINAPI DECLSPEC_HOTPATCH FormatMessageW( DWORD flags, const void *source, 
    if (flags & FORMAT_MESSAGE_ALLOCATE_BUFFER)
    {
        WCHAR *result;
+        va_list args_copy;
        ULONG alloc = max( size * sizeof(WCHAR), 65536 );
        for (;;)
@@ -5466,9 +5467,17 @@ DWORD WINAPI DECLSPEC_HOTPATCH FormatMessageW( DWORD flags, const void *source, 
                status = STATUS_NO_MEMORY;
                break;
            }
+            if (args && !(flags & FORMAT_MESSAGE_ARGUMENT_ARRAY))
+            {
+                va_copy( args_copy, *args );
                status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
-                                       FALSE, !!(flags & FORMAT_MESSAGE_ARGUMENT_ARRAY), args,
+                                           FALSE, FALSE, &args_copy, result, alloc, &retsize );
-                                       result, alloc, &retsize );
+                va_end( args_copy );
+            }
+            else
+                status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
+                                           FALSE, TRUE, args, result, alloc, &retsize );
            if (!status)
            {
                if (retsize <= sizeof(WCHAR)) HeapFree( GetProcessHeap(), 0, result );