[tkreuzer] 49513: [CRT] Fix a bug in streamout(), that could cause a buffer overrun and made msvcrt_winetest crash.

Author: tkreuzer
Date: Sat Nov  6 23:03:22 2010
New Revision: 49513

URL: http://svn.reactos.org/svn/reactos?rev=49513&view=rev
Log:
[CRT]
Fix a bug in streamout(), that could cause a buffer overrun and made msvcrt_winetest
crash.

Modified:
    trunk/reactos/lib/sdk/crt/printf/streamout.c

Modified: trunk/reactos/lib/sdk/crt/printf/streamout.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/lib/sdk/crt/printf/streamo…
==============================================================================
--- trunk/reactos/lib/sdk/crt/printf/streamout.c [iso-8859-1] (original)
+++ trunk/reactos/lib/sdk/crt/printf/streamout.c [iso-8859-1] Sat Nov  6 23:03:22 2010
@@ -551,7 +551,6 @@
                 }
                 while (val64);
 
-                while (precision-- > 0) *--string = '0';
                 len = _tcslen(string);
                 break;
 
@@ -563,7 +562,8 @@
 
         /* Calculate padding */
         prefixlen = prefix ? _tcslen(prefix) : 0;
-        padding = fieldwidth - len - prefixlen;
+        if (precision < 0) precision = 0;
+        padding = fieldwidth - len - prefixlen - precision;
 
         /* Optional left space padding */
         if ((flags & (FLAG_ALIGN_LEFT | FLAG_PAD_ZERO)) == 0)
@@ -584,13 +584,11 @@
         }
 
         /* Optional left '0' padding */
-        if ((flags & (FLAG_ALIGN_LEFT | FLAG_PAD_ZERO)) == FLAG_PAD_ZERO)
-        {
-            while (padding-- > 0)
-            {
-                if ((written = streamout_char(stream, _T('0'))) == -1) return
-4;
-                written_all += written;
-            }
+        if ((flags & FLAG_ALIGN_LEFT) == 0) precision += padding;
+        while (precision-- > 0)
+        {
+            if ((written = streamout_char(stream, _T('0'))) == -1) return -4;
+            written_all += written;
         }
 
         /* Output the string */