| commit | 1714963a5f9e62deb7aaa8f751640cbf87d57993 | |
| author | Daniel Lehman <dlehman25@gmail.com> | |
| Sat, 4 Jun 2022 15:03:02 +0000 (4 08:03 -0700) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Mon, 13 Jun 2022 14:54:30 +0000 (13 16:54 +0200) | ||
| tree | 1a56c94c413a5eea63ff9193312c3b097810fd72 | treesnapshot (tar.gz zip) |
| parent | 8986f6fadd0ed9e4ceeafde92d9005e6c8c8a226 | commitdiff |
kernelbase: Pass va_list copy to internal RtlFormatMessage.
va_list passed to RtlFormatMessage is modified even on error in this
case, if the buffer is not large enough, STATUS_BUFFER_OVERFLOW is
returned and FormatMessage tries again, but the va_list pointer is now
moved to a later argument, so the next call reads off the end,
crashing.
Signed-off-by: Daniel Lehman <dlehman25@gmail.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
va_list passed to RtlFormatMessage is modified even on error in this
case, if the buffer is not large enough, STATUS_BUFFER_OVERFLOW is
returned and FormatMessage tries again, but the va_list pointer is now
moved to a later argument, so the next call reads off the end,
crashing.
Signed-off-by: Daniel Lehman <dlehman25@gmail.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
| dlls/kernelbase/locale.c | diffblobblamehistory |