crypt32: Don't copy past end of buffer when removing a string from a multi string.

f2040b77 · Juan Lang · Alexandre Julliard · 916e38f9 · f2040b77
Commit f2040b77 authored Nov 29, 2009 by Juan Lang Committed by Alexandre Julliard Nov 30, 2009
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 2 deletions

oid.c dlls/crypt32/oid.c +4 -2

No files found.
--- a/dlls/crypt32/oid.c
+++ b/dlls/crypt32/oid.c
@@ -881,9 +881,11 @@ static BOOL CRYPT_RemoveStringFromMultiString(LPWSTR multi, LPCWSTR toRemove)
        }
        else
        {
+            LPCWSTR nextStr = spotToRemove + lstrlenW(toRemove) + 1;
            /* Copy remainder of string "left" */
-            memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
+            memmove(spotToRemove, nextStr,
-             (len - (spotToRemove - multi)) * sizeof(WCHAR));
+             (len - (nextStr - multi)) * sizeof(WCHAR));
        }
        ret = TRUE;
    }