Author: hpoussin
Date: Mon May 8 21:14:19 2006
New Revision: 21854
URL:
http://svn.reactos.ru/svn/reactos?rev=21854&view=rev
Log:
Fix bug 1448 and a possible buffer overflow.
Thanks w3seek for his help during the debugging
Modified:
trunk/reactos/dll/win32/setupapi/parser.c
Modified: trunk/reactos/dll/win32/setupapi/parser.c
URL:
http://svn.reactos.ru/svn/reactos/trunk/reactos/dll/win32/setupapi/parser.c…
==============================================================================
--- trunk/reactos/dll/win32/setupapi/parser.c (original)
+++ trunk/reactos/dll/win32/setupapi/parser.c Mon May 8 21:14:19 2006
@@ -1998,11 +1998,12 @@
/* Allocate memory for file filter */
if (DirectoryPath != NULL)
- /* "DirectoryPath\*.inf" form */
- len = strlenW(DirectoryPath) + 1 + strlenW(InfFileSpecification) + 1;
+ /* "DirectoryPath\" form */
+ len = strlenW(DirectoryPath) + 1 + 1;
else
- /* "%WINDIR%\Inf\*.inf" form */
- len = MAX_PATH + 1 + strlenW(InfDirectory) + strlenW(InfFileSpecification) + 1;
+ /* "%WINDIR%\Inf\" form */
+ len = MAX_PATH + 1 + strlenW(InfDirectory) + 1;
+ len += MAX_PATH; /* To contain file name or "*.inf" string */
pFullFileName = MyMalloc(len * sizeof(WCHAR));
if (pFullFileName == NULL)
{
@@ -2014,7 +2015,7 @@
if (DirectoryPath)
{
strcpyW(pFullFileName, DirectoryPath);
- if (pFullFileName[strlenW(pFullFileName) - 1] != '\\')
+ if (*pFullFileName && pFullFileName[strlenW(pFullFileName) - 1] !=
'\\')
strcatW(pFullFileName, BackSlash);
}
else