commit 5cc4a8915f5b9873c16a2c2b6465d795fb05d019
author James Hawkins <truiken@gmail.com> Fri Nov 10 13:26:38 2006 -0800
committer Alexandre Julliard <julliard@winehq.org> Mon Nov 13 12:46:25 2006 +0100
tree c708a564b4c6c5b98959377bc88730d0676290b2
parent d78ea3ccfa19bd16c92243b3d50293bea6589467

msi: Fix a heap corruption bug by resizing the src string before adding to it.

dlls/msi/files.c

diff --git a/dlls/msi/files.c b/dlls/msi/files.c
index 38b1f8f..dc81e6a 100644
--- a/dlls/msi/files.c
+++ b/dlls/msi/files.c
@@ -469,8 +469,13 @@
 
     *(ptr + 1) = '\0';
     ptr = strrchrW(mi->source, '\\');
+    src = msi_realloc(src, (lstrlenW(src) + lstrlenW(ptr)) * sizeof(WCHAR));
+    if (!src)
+        return ERROR_OUTOFMEMORY;
+
     lstrcatW(src, ptr + 1);
 
+    temppath[0] = '\0';
     cab = msi_download_file(src, temppath);
     lstrcpyW(mi->source, cab);