| commit | d1db29e801f378f7310fa66ff54980368db1869b | |
| author | Rob Shearman <robertshearman@gmail.com> | |
| Fri, 20 Nov 2009 14:37:13 +0000 (20 14:37 +0000) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Fri, 20 Nov 2009 15:38:39 +0000 (20 16:38 +0100) | ||
| tree | 7f2853015a6f4f8417646895c718ff4c82b554ae | treesnapshot (tar.gz zip) |
| parent | bacbfb481a5e6d8a7cdec4b57fec2d930dbf7284 | commitdiff |
ole32: Fix buffer overrun in CLIPFORMAT_UserMarshal.
The string in format is nul-terminated so use memcpy to copy it into
the buffer and don't try to nul-terminate it manually which causes a
write outside of the allocated buffer length.
Fix a similar off-by-one error in CLIPFORMAT_UserUnmarshal too. This
time it is only reading from beyond the buffer.
The string in format is nul-terminated so use memcpy to copy it into
the buffer and don't try to nul-terminate it manually which causes a
write outside of the allocated buffer length.
Fix a similar off-by-one error in CLIPFORMAT_UserUnmarshal too. This
time it is only reading from beyond the buffer.
| dlls/ole32/usrmarshal.c | diffblobblamehistory |