msi: Fix a heap corruption bug by resizing the src string before adding to it.

5cc4a891 · James Hawkins · Alexandre Julliard · d78ea3cc · 5cc4a891
Commit 5cc4a891 authored Nov 10, 2006 by James Hawkins Committed by Alexandre Julliard Nov 13, 2006
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 0 deletions

files.c dlls/msi/files.c +5 -0

No files found.
--- a/dlls/msi/files.c
+++ b/dlls/msi/files.c
@@ -469,8 +469,13 @@ static UINT download_remote_cabinet(MSIPACKAGE *package, struct media_info *mi)

    *(ptr + 1) = '\0';
    ptr = strrchrW(mi->source, '\\');
+    src = msi_realloc(src, (lstrlenW(src) + lstrlenW(ptr)) * sizeof(WCHAR));
+    if (!src)
+        return ERROR_OUTOFMEMORY;
+
    lstrcatW(src, ptr + 1);

+    temppath[0] = '\0';
    cab = msi_download_file(src, temppath);
    lstrcpyW(mi->source, cab);