richedit: Handle NULL buffer or 0 buffer length in ME_GetTextEx.

ME_GetTextEx directly handles EM_GETTEXTEX, and previously a NULL buffer would be dereferenced, and a 0 buffer length would cause nCount an underflow in the nCount value which would allow a buffer overflow to occur.

richedit: Handle NULL buffer or 0 buffer length in ME_GetTextEx.
3d89e291 · Dylan Smith · Alexandre Julliard · 5e58b29c · 3d89e291
Commit 3d89e291 authored Jul 30, 2009 by Dylan Smith Committed by Alexandre Julliard Aug 03, 2009
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

editor.c dlls/riched20/editor.c +2 -0

No files found.
--- a/dlls/riched20/editor.c
+++ b/dlls/riched20/editor.c
@@ -1863,6 +1863,8 @@ static int ME_GetTextEx(ME_TextEditor *editor, GETTEXTEX *ex, LPARAM pText)
 {
    int nStart, nCount; /* in chars */

+    if (!ex->cb || !pText) return 0;
+
    if (ex->flags & ~(GT_SELECTION | GT_USECRLF))
      FIXME("GETTEXTEX flags 0x%08x not supported\n", ex->flags & ~(GT_SELECTION | GT_USECRLF));