From d6f80bd4d4efa0e5ac7bd8b10dc71412a84d727e Mon Sep 17 00:00:00 2001 From: Johannes Anderwald Date: Tue, 15 Jun 2010 14:04:19 +0000 Subject: [PATCH] [MMIXER] - Fix buffer overflow - Dedicated to irc:igorko svn path=/trunk/; revision=47782 --- reactos/lib/drivers/sound/mmixer/sup.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/reactos/lib/drivers/sound/mmixer/sup.c b/reactos/lib/drivers/sound/mmixer/sup.c index 90b7c0143ee..e864d1db01d 100644 --- a/reactos/lib/drivers/sound/mmixer/sup.c +++ b/reactos/lib/drivers/sound/mmixer/sup.c @@ -638,9 +638,16 @@ MMixerGetDeviceName( Status = MixerContext->QueryKeyValue(hKey, L"FriendlyName", (PVOID*)&Name, &Length, &Type); if (Status == MM_STATUS_SUCCESS) { - ASSERT(Length < MAXPNAMELEN); - wcscpy(MixerInfo->MixCaps.szPname, Name); + // copy device name + MixerContext->Copy(MixerInfo->MixCaps.szPname, Name, min(wcslen(Name), MAXPNAMELEN-1) * sizeof(WCHAR)); + + // make sure its null terminated + MixerInfo->MixCaps.szPname[MAXPNAMELEN-1] = L'\0'; + + // free device name MixerContext->Free(Name); + + // done return Status; } @@ -651,8 +658,13 @@ MMixerGetDeviceName( Status = MixerContext->QueryKeyValue(hKey, L"FriendlyName", (PVOID*)&Name, &Length, &Type); if (Status == MM_STATUS_SUCCESS) { - ASSERT(Length < MAXPNAMELEN); - wcscpy(MixerInfo->MixCaps.szPname, Name); + // copy device name + MixerContext->Copy(MixerInfo->MixCaps.szPname, Name, min(wcslen(Name), MAXPNAMELEN-1) * sizeof(WCHAR)); + + // make sure its null terminated + MixerInfo->MixCaps.szPname[MAXPNAMELEN-1] = L'\0'; + + // free device name MixerContext->Free(Name); }