From 90f36847bc98107db737689aa4bd81eb8804bc4c Mon Sep 17 00:00:00 2001 From: Aleksey Bragin Date: Sat, 26 Feb 2011 16:50:20 +0000 Subject: [PATCH] [KERNEL32] - Fix buffer overwrite in GetModuleFileName(). Spotted by DPH. See issue #5964 for more details. svn path=/trunk/; revision=50912 --- reactos/dll/win32/kernel32/misc/ldr.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/reactos/dll/win32/kernel32/misc/ldr.c b/reactos/dll/win32/kernel32/misc/ldr.c index da2f5821255..6a954ae802c 100644 --- a/reactos/dll/win32/kernel32/misc/ldr.c +++ b/reactos/dll/win32/kernel32/misc/ldr.c @@ -431,10 +431,10 @@ GetModuleFileNameA ( &Module->FullDllName, FALSE); - if (nSize < Length) - SetLastErrorByStatus (STATUS_BUFFER_TOO_SMALL); - else + if (Length < nSize) lpFilename[Length] = '\0'; + else + SetLastErrorByStatus (STATUS_BUFFER_TOO_SMALL); RtlLeaveCriticalSection (Peb->LoaderLock); return Length; @@ -489,10 +489,10 @@ GetModuleFileNameW ( RtlCopyUnicodeString (&FileName, &Module->FullDllName); - if (nSize < Length) - SetLastErrorByStatus (STATUS_BUFFER_TOO_SMALL); - else + if (Length < nSize) lpFilename[Length] = L'\0'; + else + SetLastErrorByStatus (STATUS_BUFFER_TOO_SMALL); RtlLeaveCriticalSection (Peb->LoaderLock);