system/wine
system/wine
1
0
Fork 0
mirror of git://source.winehq.org/git/wine.git synced 2024-10-31 19:49:50 +00:00
Code Issues Projects Releases Packages Wiki Activity

xmllite: Don't lose terminating character when shrinking buffer.

Browse source 
The utf16 buffer is expected to be terminated by a '0' character.
Flawed buffer shrinking logic would move the buffer contents but
forget about the terminating character, which could cause reading
junk past the end of the buffer contents.

Signed-off-by: Eduard Permyakov <epermyakov@codeweavers.com>
Signed-off-by: Nikolay Sivov <nsivov@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Eduard Permyakov 2021-08-06 15:01:16 +03:00 committed by Alexandre Julliard
parent 4303e75313
commit 2d33f406c9
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
dlls/xmllite/reader.c
View file

@ -2128,6 +2128,7 @@ static HRESULT reader_parse_reference(xmlreader *reader)
memmove(start + 1, ptr + 1, len); memmove(start + 1, ptr + 1, len);
buffer->written -= (reader_get_cur(reader) - cur) * sizeof(WCHAR); buffer->written -= (reader_get_cur(reader) - cur) * sizeof(WCHAR);
*(WCHAR*)(buffer->data + buffer->written) = 0;
buffer->cur = cur + 1; buffer->cur = cur + 1;
*start = ch; *start = ch;
@ -2151,6 +2152,7 @@ static HRESULT reader_parse_reference(xmlreader *reader)
memmove(start+1, ptr+1, len); memmove(start+1, ptr+1, len);
buffer->cur = cur + 1; buffer->cur = cur + 1;
buffer->written -= (ptr - start) * sizeof(WCHAR); buffer->written -= (ptr - start) * sizeof(WCHAR);
*(WCHAR*)(buffer->data + buffer->written) = 0;
*start = ch; *start = ch;
} }