From 07b6a624cb4fa8373222cfb9ea6669e72177f089 Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Fri, 16 Aug 2002 20:00:48 +0000
Subject: [PATCH] lstrcpyn[AW] count should be considered unsigned.

---
 memory/string.c | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/memory/string.c b/memory/string.c
index 8e33fa2103a..0d756dc1321 100644
--- a/memory/string.c
+++ b/memory/string.c
@@ -183,12 +183,18 @@ SEGPTR WINAPI lstrcpyn16( SEGPTR dst, LPCSTR src, INT16 n )
  *           lstrcpynA   (KERNEL32.@)
  *
  * Note: this function differs from the UNIX strncpy, it _always_ writes
- * a terminating \0
+ * a terminating \0.
+ *
+ * Note: n is an INT but Windows treats it as unsigned, and will happily
+ * copy a gazillion chars if n is negative.
  */
 LPSTR WINAPI lstrcpynA( LPSTR dst, LPCSTR src, INT n )
 {
     LPSTR p = dst;
+    UINT count = n;
+
     TRACE("(%p, %s, %i)\n", dst, debugstr_a(src), n);
+
     /* In real windows the whole function is protected by an exception handler
      * that returns ERROR_INVALID_PARAMETER on faulty parameters
      * We currently just check for NULL.
@@ -197,21 +203,32 @@ LPSTR WINAPI lstrcpynA( LPSTR dst, LPCSTR src, INT n )
     	SetLastError(ERROR_INVALID_PARAMETER);
 	return 0;
     }
-    while ((n-- > 1) && *src) *p++ = *src++;
-    if (n >= 0) *p = 0;
+    while ((count > 1) && *src)
+    {
+        count--;
+        *p++ = *src++;
+    }
+    if (count) *p = 0;
     return dst;
 }
 
 
 /***********************************************************************
  *           lstrcpynW   (KERNEL32.@)
+ *
  * Note: this function differs from the UNIX strncpy, it _always_ writes
  * a terminating \0
+ *
+ * Note: n is an INT but Windows treats it as unsigned, and will happily
+ * copy a gazillion chars if n is negative.
  */
 LPWSTR WINAPI lstrcpynW( LPWSTR dst, LPCWSTR src, INT n )
 {
     LPWSTR p = dst;
+    UINT count = n;
+
     TRACE("(%p, %s, %i)\n", dst,  debugstr_w(src), n);
+
     /* In real windows the whole function is protected by an exception handler
      * that returns ERROR_INVALID_PARAMETER on faulty parameters
      * We currently just check for NULL.
@@ -220,8 +237,12 @@ LPWSTR WINAPI lstrcpynW( LPWSTR dst, LPCWSTR src, INT n )
     	SetLastError(ERROR_INVALID_PARAMETER);
 	return 0;
     }
-    while ((n-- > 1) && *src) *p++ = *src++;
-    if (n >= 0) *p = 0;
+    while ((count > 1) && *src)
+    {
+        count--;
+        *p++ = *src++;
+    }
+    if (count) *p = 0;
     return dst;
 }