ApfelTeeSaft/reactos
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/reactos.git synced 2026-09-02 12:23:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

[FRAMEDYN]

Browse Source 
- Fix integer overflow checks. CID 1101981, 1248380, 1248381

svn path=/trunk/; revision=73633
This commit is contained in:
Thomas Faber
2017-01-30 13:15:41 +00:00
parent dacd843616
commit c8ec5e1a66
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
reactos/dll/win32/framedyn/chstring.cpp
+3 -3
View File
@@ -288,7 +288,7 @@ void CHString::AllocBuffer(int nSize) throw (CHeap_Exception)
}
// Nor too big
if (nSize > INT_MAX)
if (nSize > (INT_MAX - (int)sizeof(CHStringData)) / (int)sizeof(WCHAR))
{
RaiseException(STATUS_INTEGER_OVERFLOW, EXCEPTION_NONCONTINUABLE, 0, 0);
}
@@ -442,7 +442,7 @@ void CHString::ConcatInPlace(int nSrcLen, LPCWSTR lpszSrcData)
}
// Ensure we wouldn't overflow with the concat
if (GetData()->nDataLength + nSrcLen > INT_MAX)
if (GetData()->nDataLength > INT_MAX - nSrcLen)
{
RaiseException(STATUS_INTEGER_OVERFLOW, EXCEPTION_NONCONTINUABLE, 0, 0);
}
@@ -461,7 +461,7 @@ void CHString::ConcatInPlace(int nSrcLen, LPCWSTR lpszSrcData)
else
{
// Ensure we don't overflow
if (nSrcLen > INT_MAX)
if (nSrcLen > INT_MAX - GetData()->nDataLength)
{
RaiseException(STATUS_INTEGER_OVERFLOW, EXCEPTION_NONCONTINUABLE, 0, 0);
}