From c8ec5e1a669256e5a2116bb3c40e13dec06b40c5 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Mon, 30 Jan 2017 13:15:41 +0000
Subject: [PATCH] [FRAMEDYN] - Fix integer overflow checks. CID 1101981,
 1248380, 1248381

svn path=/trunk/; revision=73633
---
 reactos/dll/win32/framedyn/chstring.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/reactos/dll/win32/framedyn/chstring.cpp b/reactos/dll/win32/framedyn/chstring.cpp
index d9bf714993e..f8779c0b277 100644
--- a/reactos/dll/win32/framedyn/chstring.cpp
+++ b/reactos/dll/win32/framedyn/chstring.cpp
@@ -288,7 +288,7 @@ void CHString::AllocBuffer(int nSize) throw (CHeap_Exception)
     }
 
     // Nor too big
-    if (nSize > INT_MAX)
+    if (nSize > (INT_MAX - (int)sizeof(CHStringData)) / (int)sizeof(WCHAR))
     {
         RaiseException(STATUS_INTEGER_OVERFLOW, EXCEPTION_NONCONTINUABLE, 0, 0);
     }
@@ -442,7 +442,7 @@ void CHString::ConcatInPlace(int nSrcLen, LPCWSTR lpszSrcData)
     }
 
     // Ensure we wouldn't overflow with the concat
-    if (GetData()->nDataLength + nSrcLen > INT_MAX)
+    if (GetData()->nDataLength > INT_MAX - nSrcLen)
     {
         RaiseException(STATUS_INTEGER_OVERFLOW, EXCEPTION_NONCONTINUABLE, 0, 0);
     }
@@ -461,7 +461,7 @@ void CHString::ConcatInPlace(int nSrcLen, LPCWSTR lpszSrcData)
     else
     {
         // Ensure we don't overflow
-        if (nSrcLen > INT_MAX)
+        if (nSrcLen > INT_MAX - GetData()->nDataLength)
         {
             RaiseException(STATUS_INTEGER_OVERFLOW, EXCEPTION_NONCONTINUABLE, 0, 0);
         }