From 427e2bb60995300d479fba602362a24147d76a2c Mon Sep 17 00:00:00 2001
From: Piotr Caban <piotr@codeweavers.com>
Date: Tue, 15 Sep 2020 11:55:37 +0200
Subject: [PATCH] msvcrt: Fix buffer overflow in _write function.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=49770
Signed-off-by: Piotr Caban <piotr@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/msvcrt/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dlls/msvcrt/file.c b/dlls/msvcrt/file.c
index a37aa87b5dd..602fe6d1df9 100644
--- a/dlls/msvcrt/file.c
+++ b/dlls/msvcrt/file.c
@@ -3504,7 +3504,8 @@ int CDECL MSVCRT__write(int fd, const void* buf, unsigned int count)
             }
 #endif
 
-            for (;  i < count && j < sizeof(conv)-1; i++, j++, len++)
+            for (; i < count && j < sizeof(conv)-1 &&
+                    len < (sizeof(lfbuf) - 1) / sizeof(WCHAR); i++, j++, len++)
             {
                 if (MSVCRT_isleadbyte((unsigned char)s[i]))
                 {