| commit | c4b023b1b6d13552e3432f754b1dd3a70b5e5edb | |
| author | Dylan Smith <dylan.ah.smith@gmail.com> | |
| Thu, 30 Jul 2009 04:54:21 +0000 (30 00:54 -0400) | ||
| committer | Alexandre Julliard <julliard@winehq.org> | |
| Mon, 3 Aug 2009 14:00:16 +0000 (3 16:00 +0200) | ||
| tree | 21b1f015febc322a9fffa2733f8335e125221436 | treesnapshot (tar.gz zip) |
| parent | 3d89e29155dc3a359026caed50840d5a57ab2510 | commitdiff |
richedit: Prevent buffer overflows in WM_GETTEXT.
The application AutoGK was getting the length of the text with
WM_GETTEXTLENGTH to allocate an appropriate buffer size, but then
claimed the buffer was twice the size when sending WM_GETTEXTEX. This
caused the memcpy call to overflow the actual buffer since the count
is based on the size of the buffer alone, regardless of the amount of
text retrieved.
The application AutoGK was getting the length of the text with
WM_GETTEXTLENGTH to allocate an appropriate buffer size, but then
claimed the buffer was twice the size when sending WM_GETTEXTEX. This
caused the memcpy call to overflow the actual buffer since the count
is based on the size of the buffer alone, regardless of the amount of
text retrieved.
| dlls/riched20/editor.c | diffblobblamehistory |