system/wine
system/wine
1
0
Fork 0
mirror of git://source.winehq.org/git/wine.git synced 2024-10-04 17:56:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

xmllite: Avoid out of bounds access in readerinput_get_utf8_convlen().

Browse source 
And consequently in readerinput_shrinkraw().

Signed-off-by: Paul Gofman <pgofman@codeweavers.com>
Signed-off-by: Nikolay Sivov <nsivov@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Paul Gofman 2021-04-15 12:50:10 +03:00 committed by Alexandre Julliard
parent a0b77d7151
commit 82d69d8ba9
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
dlls/xmllite/reader.c
View file

@ -844,6 +844,8 @@ static HRESULT readerinput_growraw(xmlreaderinput *readerinput)
readerinput->pending = hr == E_PENDING;
if (FAILED(hr)) return hr;
buffer->written += read;
if (!buffer->written)
return MX_E_INPUTEND;
return hr;
}
@ -929,6 +931,8 @@ static int readerinput_get_utf8_convlen(xmlreaderinput *readerinput)
encoded_buffer *buffer = &readerinput->buffer->encoded;
int len = buffer->written;
assert(len);
/* complete single byte char */
if (!(buffer->data[len-1] & 0x80)) return len;
@ -966,6 +970,7 @@ static void readerinput_shrinkraw(xmlreaderinput *readerinput, int len)
if (len == -1)
len = readerinput_get_convlen(readerinput);
assert(len >= 0);
memmove(buffer->data, buffer->data + buffer->cur + (buffer->written - len), len);
/* everything below cur is lost too */
buffer->written -= len + buffer->cur;
@ -1068,7 +1073,9 @@ static HRESULT reader_more(xmlreader *reader)
WCHAR *ptr;
/* get some raw data from stream first */
hr = readerinput_growraw(readerinput);
if (FAILED(hr = readerinput_growraw(readerinput)))
return hr;
len = readerinput_get_convlen(readerinput);
prev_len = dest->written / sizeof(WCHAR);