Re: [PATCH] msvcrt: fix character/byte confusion in buffer overflow branch

2013-05-11 Thread Max Kellermann
On 2013/05/07 17:46, Juan Lang wrote: > In general, I think you want to send this to wine-patches, not here. True, I resent it to wine-patches yesterday already, when I noticed that. > > if(out->len < len) { > > -memcpy(out->buf, str, out->len); > > +memcpy(out->buf, str, ou

[PATCH] msvcrt: fix character/byte confusion in buffer overflow branch

2013-05-07 Thread Max Kellermann
The first memcpy() call in puts_clbk_str_w() confuses character count and byte count. It uses the number of characters (out->len) as number of bytes. This leaves half of the buffer undefined. Interestingly, the second memcpy() call in the same function is correct. This bug potentially makes app