Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-06 07:52:56 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix a buffer overflow in ConvertULargeInteger

Browse source 
svn path=/trunk/; revision=42623
This commit is contained in:
Jeffrey Morlan 2009-08-11 16:21:46 +00:00
parent 555a242381
commit d05d3811ed
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
reactos/base/shell/cmd/cmd.c
View file

@ -182,7 +182,7 @@ WORD wDefColor; /* default color */
INT INT
ConvertULargeInteger(ULONGLONG num, LPTSTR des, INT len, BOOL bPutSeperator) ConvertULargeInteger(ULONGLONG num, LPTSTR des, INT len, BOOL bPutSeperator)
{ {
TCHAR temp[32]; TCHAR temp[39]; /* maximum length with nNumberGroups == 1 */
UINT n, iTarget; UINT n, iTarget;
if (len <= 1) if (len <= 1)
@ -198,15 +198,15 @@ ConvertULargeInteger(ULONGLONG num, LPTSTR des, INT len, BOOL bPutSeperator)
if (iTarget == n && bPutSeperator) if (iTarget == n && bPutSeperator)
{ {
iTarget += nNumberGroups + 1; iTarget += nNumberGroups + 1;
temp[31 - n++] = cThousandSeparator; temp[38 - n++] = cThousandSeparator;
} }
temp[31 - n++] = (TCHAR)(num % 10) + _T('0'); temp[38 - n++] = (TCHAR)(num % 10) + _T('0');
num /= 10; num /= 10;
} while (num > 0); } while (num > 0);
if (n > len-1) if (n > len-1)
n = len-1; n = len-1;
memcpy(des, temp + 32 - n, n * sizeof(TCHAR)); memcpy(des, temp + 39 - n, n * sizeof(TCHAR));
des[n] = _T('\0'); des[n] = _T('\0');
return n; return n;