[ros-diffs] [gdalsnes] 18490: fix two buffer overflows

fix two buffer overflows
Modified: trunk/reactos/subsys/csrss/init.c
  _____  

Modified: trunk/reactos/subsys/csrss/init.c
--- trunk/reactos/subsys/csrss/init.c	2005-10-16 01:26:52 UTC (rev
18489)
+++ trunk/reactos/subsys/csrss/init.c	2005-10-16 01:27:32 UTC (rev
18490)
@@ -401,16 +401,21 @@

 	AnsiEnv.Buffer = RtlAllocateHeap (RtlGetProcessHeap(), 0,
CharCount);
 	if (NULL != AnsiEnv.Buffer)
 	{
+
 		PCHAR WritePos = AnsiEnv.Buffer;
 		
 		for (Index=0; NULL != envp[Index]; Index++)
 		{
-			strcat (WritePos, envp[Index]);
+			strcpy (WritePos, envp[Index]);
 			WritePos += strlen (envp[Index]) + 1;
 		}
-		AnsiEnv.Buffer [CharCount] = '\0';
+
+      /* FIXME: the last (double) nullterm should perhaps not be
included in Length
+       * but only in MaximumLength. -Gunnar */
+		AnsiEnv.Buffer [CharCount-1] = '\0';
 		AnsiEnv.Length             = CharCount;
 		AnsiEnv.MaximumLength      = CharCount;
+      
 		RtlAnsiStringToUnicodeString (UnicodeEnv, & AnsiEnv,
TRUE);
 		RtlFreeHeap (RtlGetProcessHeap(), 0, AnsiEnv.Buffer);
 	}