From 5537fbbcfffcf00c590017dd645049b97ca657fc Mon Sep 17 00:00:00 2001
From: Aric Stewart <aric@codeweavers.com>
Date: Thu, 21 Sep 2006 09:43:00 -0500
Subject: [PATCH] user: Correct buffer overflows in IME processing code.

---
 dlls/user/edit.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/user/edit.c b/dlls/user/edit.c
index c4f95e48a1d..116340f51ce 100644
--- a/dlls/user/edit.c
+++ b/dlls/user/edit.c
@@ -5341,7 +5341,7 @@ static void EDIT_GetCompositionStr(HWND hwnd, LPARAM CompFlag, EDITSTATE *es)
         return;
     }
 
-    lpCompStr = HeapAlloc(GetProcessHeap(),0,dwBufLen);
+    lpCompStr = HeapAlloc(GetProcessHeap(),0,dwBufLen + sizeof(WCHAR));
     if (!lpCompStr)
     {
         ERR("Unable to allocate IME CompositionString\n");
@@ -5362,7 +5362,7 @@ static void EDIT_GetCompositionStr(HWND hwnd, LPARAM CompFlag, EDITSTATE *es)
         if (dwBufLenAttr)
         {
             dwBufLenAttr ++;
-            lpCompStrAttr = HeapAlloc(GetProcessHeap(),0,dwBufLenAttr);
+            lpCompStrAttr = HeapAlloc(GetProcessHeap(),0,dwBufLenAttr+1);
             if (!lpCompStrAttr)
             {
                 ERR("Unable to allocate IME Attribute String\n");
@@ -5417,7 +5417,7 @@ static void EDIT_GetResultStr(HWND hwnd, EDITSTATE *es)
         return;
     }
 
-    lpResultStr = HeapAlloc(GetProcessHeap(),0, dwBufLen);
+    lpResultStr = HeapAlloc(GetProcessHeap(),0, dwBufLen+sizeof(WCHAR));
     if (!lpResultStr)
     {
         ERR("Unable to alloc buffer for IME string\n");