cmd: Don't overflow parameter length when copying substring.

7c3f3d09 · Jason Edmeades · Alexandre Julliard · 37035e53 · 7c3f3d09 · 7c3f3d09
Commit 7c3f3d09 authored Oct 25, 2012 by Jason Edmeades Committed by Alexandre Julliard Nov 06, 2012
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

test_builtins.cmd.exp programs/cmd/tests/test_builtins.cmd.exp +1 -1

wcmdmain.c programs/cmd/wcmdmain.c +1 -0

No files found.
--- a/programs/cmd/tests/test_builtins.cmd.exp
+++ b/programs/cmd/tests/test_builtins.cmd.exp
@@ -275,7 +275,7 @@ P0S
 q
 qwe
 er
-@todo_wine@'ty'@or_broken@''
+'ty'@or_broken@''
 't'@or_broken@''
 ert@or_broken@qwerty
 e@or_broken@qwerty

--- a/programs/cmd/wcmdmain.c
+++ b/programs/cmd/wcmdmain.c
@@ -730,6 +730,7 @@ static WCHAR *WCMD_expand_envvar(WCHAR *start,
        else if (copybytes < 0) copybytes = 0;
        WCMD_strsubstW(start, endOfVar + 1, startCopy, copybytes);
      } else {
+        substrlength = min(substrlength, len - (startCopy- thisVarContents + 1));
        WCMD_strsubstW(start, endOfVar + 1, startCopy, substrlength);
      }