From 79ad9cbcdd91559c04a6d519c4d9e718bab970a0 Mon Sep 17 00:00:00 2001
From: Rob Shearman <robertshearman@gmail.com>
Date: Wed, 1 Oct 2008 11:19:31 +0100
Subject: [PATCH] cabinet: Check buffer size before copying in NONEfdi_decomp.

Check that the data will fit into the fixed sized buffer CAB(outbuf)
and return an error if not before copying.
---
 dlls/cabinet/fdi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/cabinet/fdi.c b/dlls/cabinet/fdi.c
index 4c499dd2935..35ad5401d4d 100644
--- a/dlls/cabinet/fdi.c
+++ b/dlls/cabinet/fdi.c
@@ -911,6 +911,7 @@ static int LZXfdi_init(int window, fdi_decomp_state *decomp_state) {
 static int NONEfdi_decomp(int inlen, int outlen, fdi_decomp_state *decomp_state)
 {
   if (inlen != outlen) return DECR_ILLEGALDATA;
+  if (outlen > CAB_BLOCKMAX) return DECR_DATAFORMAT;
   memcpy(CAB(outbuf), CAB(inbuf), (size_t) inlen);
   return DECR_OK;
 }