| commit | 74c0c0574ea720c8278d312dcff77aaba0bdb699 | |
| author | Gabriel Ivăncescu <gabrielopcode@gmail.com> | |
| Mon, 10 Sep 2018 19:09:31 +0000 (10 22:09 +0300) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Tue, 11 Sep 2018 12:09:52 +0000 (11 14:09 +0200) | ||
| tree | 10dd76c8418450e31170cb227e0b263438710a0d | treesnapshot (tar.gz zip) |
| parent | be3a3ad825a8b64e585630b0e30de7165be5b6cb | commitdiff |
shell32/autocomplete: Fix a vulnerability by avoiding the use of snprintf.
The quickComplete format can have more than one % argument, or stuff like
%*.* or %1234s, which can be exploited since the format string can be read
from the registry, so handle it manually instead of using sprintf.
Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
The quickComplete format can have more than one % argument, or stuff like
%*.* or %1234s, which can be exploited since the format string can be read
from the registry, so handle it manually instead of using sprintf.
Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
| dlls/shell32/autocomplete.c | diffblobblamehistory |