commit 5537fbbcfffcf00c590017dd645049b97ca657fc
author Aric Stewart <aric@codeweavers.com> Thu Sep 21 09:43:00 2006 -0500
committer Alexandre Julliard <julliard@winehq.org> Mon Sep 25 18:13:21 2006 +0200
tree 8416099e587c30a850abf78dc081e5ef64308d47
parent 966c5b6c0b42812a7fbc0e8a5d5a9589f77d966d

user: Correct buffer overflows in IME processing code.

dlls/user/edit.c

diff --git a/dlls/user/edit.c b/dlls/user/edit.c
index c4f95e4..116340f 100644
--- a/dlls/user/edit.c
+++ b/dlls/user/edit.c
@@ -5341,7 +5341,7 @@
         return;
     }
 
-    lpCompStr = HeapAlloc(GetProcessHeap(),0,dwBufLen);
+    lpCompStr = HeapAlloc(GetProcessHeap(),0,dwBufLen + sizeof(WCHAR));
     if (!lpCompStr)
     {
         ERR("Unable to allocate IME CompositionString\n");
@@ -5362,7 +5362,7 @@
         if (dwBufLenAttr)
         {
             dwBufLenAttr ++;
-            lpCompStrAttr = HeapAlloc(GetProcessHeap(),0,dwBufLenAttr);
+            lpCompStrAttr = HeapAlloc(GetProcessHeap(),0,dwBufLenAttr+1);
             if (!lpCompStrAttr)
             {
                 ERR("Unable to allocate IME Attribute String\n");
@@ -5417,7 +5417,7 @@
         return;
     }
 
-    lpResultStr = HeapAlloc(GetProcessHeap(),0, dwBufLen);
+    lpResultStr = HeapAlloc(GetProcessHeap(),0, dwBufLen+sizeof(WCHAR));
     if (!lpResultStr)
     {
         ERR("Unable to alloc buffer for IME string\n");