msi: Fix a buffer overrun.

Signed-off-by: Zebediah Figura <z.figura12@gmail.com> Signed-off-by: Hans Leidekker <hans@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

msi: Fix a buffer overrun.
39b841d1 · Zebediah Figura · Alexandre Julliard · 48848155 · 39b841d1
Commit 39b841d1 authored Jun 29, 2017 by Zebediah Figura Committed by Alexandre Julliard Jun 29, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 3 deletions

package.c dlls/msi/package.c +3 -3

No files found.
--- a/dlls/msi/package.c
+++ b/dlls/msi/package.c
@@ -1812,17 +1812,17 @@ INT MSI_ProcessMessage( MSIPACKAGE *package, INSTALLMESSAGE eMessageType, MSIREC
    {
        WCHAR template_s[1024];
        WCHAR *template_rec, *template;
-        DWORD length;

        LoadStringW(msi_hInstance, IDS_INFO, template_s, 1024);

-        res = MSI_RecordGetStringW(record, 0, NULL, &length);
+        res = MSI_RecordGetStringW(record, 0, NULL, &len);
        if (res != ERROR_SUCCESS && res != ERROR_MORE_DATA)
            return res;
        len++;
        template_rec = msi_alloc(len * sizeof(WCHAR));
        if (!template_rec) return ERROR_OUTOFMEMORY;
-        MSI_RecordGetStringW(record, 0, template_rec, &length);
+        MSI_RecordGetStringW(record, 0, template_rec, &len);
+        len++;

        template = msi_alloc((len + strlenW(template_s)) * sizeof(WCHAR));
        if (!template) return ERROR_OUTOFMEMORY;