| commit | 3d89e29155dc3a359026caed50840d5a57ab2510 | |
| author | Dylan Smith <dylan.ah.smith@gmail.com> | |
| Thu, 30 Jul 2009 04:54:13 +0000 (30 00:54 -0400) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Mon, 3 Aug 2009 13:59:57 +0000 (3 15:59 +0200) | ||
| tree | 5c9df8fa48d6b7e390dfcc9d06b96f9ac87a98e7 | treesnapshot (tar.gz zip) |
| parent | 5e58b29cfec3a9a34ecdae90defc088953edad26 | commitdiff |
richedit: Handle NULL buffer or 0 buffer length in ME_GetTextEx.
ME_GetTextEx directly handles EM_GETTEXTEX, and previously a NULL buffer
would be dereferenced, and a 0 buffer length would cause nCount an
underflow in the nCount value which would allow a buffer overflow to
occur.
ME_GetTextEx directly handles EM_GETTEXTEX, and previously a NULL buffer
would be dereferenced, and a 0 buffer length would cause nCount an
underflow in the nCount value which would allow a buffer overflow to
occur.
| dlls/riched20/editor.c | diffblobblamehistory |