user32: Fix wsprintfA's buffer usage when using %S.

This fixes a regression introduced by 08bf605a. It could lead to stack corruption because ret can be negative when the output position, p, doesn't point the beginning of the buffer before the inner loop. Signed-off-by: Akihiro Sagawa <sagawa.aki@gmail.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

user32: Fix wsprintfA's buffer usage when using %S.
8baf70a2 · Akihiro Sagawa · Alexandre Julliard · 31800a14 · 8baf70a2
Commit 8baf70a2 authored Aug 02, 2020 by Akihiro Sagawa Committed by Alexandre Julliard Aug 03, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

wsprintf.c dlls/user32/wsprintf.c +1 -1

No files found.
--- a/dlls/user32/wsprintf.c
+++ b/dlls/user32/wsprintf.c
@@ -413,8 +413,8 @@ static INT wvsnprintfA( LPSTR buffer, UINT maxlen, LPCSTR spec, __ms_va_list arg
                {
                    CHAR mb[5]; /* 5 is MB_LEN_MAX */
                    int ret = WideCharToMultiByte( CP_ACP, 0, ptr, 1, mb, sizeof(mb), NULL, NULL );
+                    if (ret > len - i) ret = len - i;
                    i += ret;
-                    if (i > len) ret = len - (p - buffer);
                    memcpy( p, mb, ret );
                    p += ret;
                }