From eb37e2e482451e4e67cf7de8df5616e444d29278 Mon Sep 17 00:00:00 2001 From: Daniel Lehman Date: Fri, 17 Aug 2018 18:51:29 +0200 Subject: [PATCH] msvcrt: Don't read past end of string in _strnicoll/_wcsnicoll. Signed-off-by: Daniel Lehman Signed-off-by: Piotr Caban Signed-off-by: Alexandre Julliard --- dlls/msvcrt/string.c | 3 ++- dlls/msvcrt/wcs.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/dlls/msvcrt/string.c b/dlls/msvcrt/string.c index 37bc22439d2..b58d56bd208 100644 --- a/dlls/msvcrt/string.c +++ b/dlls/msvcrt/string.c @@ -694,7 +694,8 @@ int CDECL MSVCRT__strnicoll_l( const char* str1, const char* str2, MSVCRT_size_t if(!locinfo->lc_handle[MSVCRT_LC_COLLATE]) return strncasecmp(str1, str2, count); return CompareStringA(locinfo->lc_handle[MSVCRT_LC_COLLATE], NORM_IGNORECASE, - str1, count, str2, count)-CSTR_EQUAL; + str1, MSVCRT_strnlen(str1, count), + str2, MSVCRT_strnlen(str2, count))-CSTR_EQUAL; } /********************************************************************* diff --git a/dlls/msvcrt/wcs.c b/dlls/msvcrt/wcs.c index 3b22f62275a..c2a44748d60 100644 --- a/dlls/msvcrt/wcs.c +++ b/dlls/msvcrt/wcs.c @@ -151,7 +151,8 @@ int CDECL MSVCRT__wcsnicoll_l(const MSVCRT_wchar_t* str1, const MSVCRT_wchar_t* if(!locinfo->lc_handle[MSVCRT_LC_COLLATE]) return strncmpiW(str1, str2, count); return CompareStringW(locinfo->lc_handle[MSVCRT_LC_COLLATE], NORM_IGNORECASE, - str1, count, str2, count)-CSTR_EQUAL; + str1, MSVCRT_wcsnlen(str1, count), + str2, MSVCRT_wcsnlen(str2, count))-CSTR_EQUAL; } /*********************************************************************