msi: Fix a heap corruption bug by resizing the src string before adding to it.
This commit is contained in:
parent
d78ea3ccfa
commit
5cc4a8915f
|
@ -469,8 +469,13 @@ static UINT download_remote_cabinet(MSIPACKAGE *package, struct media_info *mi)
|
||||||
|
|
||||||
*(ptr + 1) = '\0';
|
*(ptr + 1) = '\0';
|
||||||
ptr = strrchrW(mi->source, '\\');
|
ptr = strrchrW(mi->source, '\\');
|
||||||
|
src = msi_realloc(src, (lstrlenW(src) + lstrlenW(ptr)) * sizeof(WCHAR));
|
||||||
|
if (!src)
|
||||||
|
return ERROR_OUTOFMEMORY;
|
||||||
|
|
||||||
lstrcatW(src, ptr + 1);
|
lstrcatW(src, ptr + 1);
|
||||||
|
|
||||||
|
temppath[0] = '\0';
|
||||||
cab = msi_download_file(src, temppath);
|
cab = msi_download_file(src, temppath);
|
||||||
lstrcpyW(mi->source, cab);
|
lstrcpyW(mi->source, cab);
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue