reactos/wine
1
0
Fork 0
mirror of https://github.com/reactos/wine.git synced 2025-01-22 03:49:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed RtlExpandEnvironmentStrings_U to not depend on the string being

Browse Source 
null-terminated (spotted by Alexander Yaworsky).
This commit is contained in:
Alexandre Julliard 2004-11-29 18:24:08 +00:00
parent 174ae13752
commit 7e11e528c1
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
dlls/ntdll/env.c
View File

@ -268,11 +268,12 @@ done:
NTSTATUS WINAPI RtlExpandEnvironmentStrings_U(PWSTR renv, const UNICODE_STRING* us_src,
PUNICODE_STRING us_dst, PULONG plen)
{
DWORD len, count, total_size = 1; /* 1 for terminating '\0' */
DWORD src_len, len, count, total_size = 1; /* 1 for terminating '\0' */
LPCWSTR env, src, p, var;
LPWSTR dst;
src = us_src->Buffer;
src_len = us_src->Length / sizeof(WCHAR);
count = us_dst->MaximumLength / sizeof(WCHAR);
dst = count ? us_dst->Buffer : NULL;
@ -283,23 +284,25 @@ NTSTATUS WINAPI RtlExpandEnvironmentStrings_U(PWSTR renv, const UNICODE_STRING*
}
else env = renv;
while (*src)
while (src_len)
{
if (*src != '%')
{
if ((p = strchrW( src, '%' ))) len = p - src;
else len = strlenW(src);
if ((p = memchrW( src, '%', src_len ))) len = p - src;
else len = src_len;
var = src;
src += len;
src_len -= len;
}
else /* we are at the start of a variable */
{
if ((p = strchrW( src + 1, '%' )))
if ((p = memchrW( src + 1, '%', src_len - 1 )))
{
len = p - src - 1; /* Length of the variable name */
if ((var = ENV_FindVariable( env, src + 1, len )))
{
src += len + 2; /* Skip the variable name */
src_len -= len + 2;
len = strlenW(var);
}
else
@ -307,13 +310,15 @@ NTSTATUS WINAPI RtlExpandEnvironmentStrings_U(PWSTR renv, const UNICODE_STRING*
var = src; /* Copy original name instead */
len += 2;
src += len;
src_len -= len;
}
}
else /* unfinished variable name, ignore it */
{
var = src;
len = strlenW(src); /* Copy whole string */
len = src_len; /* Copy whole string */
src += len;
src_len = 0;
}
}
total_size += len;