[ros-diffs] [reactos] 01/01: [UDFS] Fix an integer overflow leading to a buffer overrun

[Pierre Schweitzer]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=2a104321ee1f212bc2eb0…

commit 2a104321ee1f212bc2eb0a9616b5a453df835ccc
Author:     Pierre Schweitzer <pierre(a)reactos.org>
AuthorDate: Thu Apr 4 15:08:21 2019 +0200
Commit:     Pierre Schweitzer <pierre(a)reactos.org>
CommitDate: Thu Apr 4 15:08:21 2019 +0200

    [UDFS] Fix an integer overflow leading to a buffer overrun
    
    Spotted by GCC7
---
 drivers/filesystems/udfs/Include/mem_tools.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/filesystems/udfs/Include/mem_tools.h
b/drivers/filesystems/udfs/Include/mem_tools.h
index 7dfc8ed482..11d92544db 100644
--- a/drivers/filesystems/udfs/Include/mem_tools.h
+++ b/drivers/filesystems/udfs/Include/mem_tools.h
@@ -265,7 +265,7 @@ ULONG inline MyReallocPool__(PCHAR addr, ULONG len, PCHAR *pnewaddr,
ULONG newle
             RtlCopyMemory(newaddr, addr, newlen);
         } else {
             RtlCopyMemory(newaddr, addr, len);
-            RtlZeroMemory(newaddr+len, newlen - len);
+            RtlZeroMemory(newaddr+len, _newlen - len);
         }
 #ifdef MY_MEM_BOUNDS_CHECK
         for(i=0; i<MY_HEAP_ALIGN+1; i++) {