[janderwald] 47782: [MMIXER] - Fix buffer overflow - Dedicated to irc:igorko

Author: janderwald
Date: Tue Jun 15 14:04:19 2010
New Revision: 47782

URL: http://svn.reactos.org/svn/reactos?rev=47782&view=rev
Log:
[MMIXER]
- Fix buffer overflow
- Dedicated to irc:igorko

Modified:
    trunk/reactos/lib/drivers/sound/mmixer/sup.c

Modified: trunk/reactos/lib/drivers/sound/mmixer/sup.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/lib/drivers/sound/mmixer/su...
==============================================================================
--- trunk/reactos/lib/drivers/sound/mmixer/sup.c [iso-8859-1] (original)
+++ trunk/reactos/lib/drivers/sound/mmixer/sup.c [iso-8859-1] Tue Jun 15 14:04:19 2010
@@ -638,9 +638,16 @@
     Status = MixerContext->QueryKeyValue(hKey, L"FriendlyName", (PVOID*)&Name, &Length, &Type);
     if (Status == MM_STATUS_SUCCESS)
     {
-        ASSERT(Length < MAXPNAMELEN);
-        wcscpy(MixerInfo->MixCaps.szPname, Name);
+        // copy device name
+        MixerContext->Copy(MixerInfo->MixCaps.szPname, Name, min(wcslen(Name), MAXPNAMELEN-1) * sizeof(WCHAR));
+
+        // make sure its null terminated
+        MixerInfo->MixCaps.szPname[MAXPNAMELEN-1] = L'\0';
+
+        // free device name
         MixerContext->Free(Name);
+
+        // done
         return Status;
     }

@@ -651,8 +658,13 @@
     Status = MixerContext->QueryKeyValue(hKey, L"FriendlyName", (PVOID*)&Name, &Length, &Type);
     if (Status == MM_STATUS_SUCCESS)
     {
-        ASSERT(Length < MAXPNAMELEN);
-        wcscpy(MixerInfo->MixCaps.szPname, Name);
+        // copy device name
+        MixerContext->Copy(MixerInfo->MixCaps.szPname, Name, min(wcslen(Name), MAXPNAMELEN-1) * sizeof(WCHAR));
+
+        // make sure its null terminated
+        MixerInfo->MixCaps.szPname[MAXPNAMELEN-1] = L'\0';
+
+        // free device name
         MixerContext->Free(Name);
     }