Author: tfaber Date: Sun May 22 19:09:49 2016 New Revision: 71379 URL: http://svn.reactos.org/svn/reactos?rev=71379&view=rev Log: [SETUPAPI] - Fix Buffer overflow in FixupServiceBinaryPath
Modified: trunk/reactos/dll/win32/setupapi/install.c Modified: trunk/reactos/dll/win32/setupapi/install.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/setupapi/install.c?rev=71379&r1=71378&r2=71379&view=diff ============================================================================== --- trunk/reactos/dll/win32/setupapi/install.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/setupapi/install.c [iso-8859-1] Sun May 22 19:09:49 2016 @@ -1748,10 +1748,8 @@ /* Handle Win32-services differently */ if (ServiceType & SERVICE_WIN32) { - Win32Length = (ServiceLength - - RosDirLength - 1 + 13) * sizeof(WCHAR); - /* -1 to not count the separator after C:\ReactOS - wcslen(L"%SystemRoot%\\") = 13*sizeof(wchar_t) */ + Win32Length = (ServiceLength - RosDirLength) * sizeof(WCHAR) + - sizeof(L'\\') + sizeof(L"%SystemRoot%\\"); Buffer = MyMalloc(Win32Length); wcscpy(Buffer, L"%SystemRoot%\\");