You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by mt...@apache.org on 2012/02/01 15:22:30 UTC
svn commit: r1239143 -
/commons/proper/daemon/branches/1.0.x/src/native/windows/src/utils.c
Author: mturk
Date: Wed Feb 1 14:22:30 2012
New Revision: 1239143
URL: http://svn.apache.org/viewvc?rev=1239143&view=rev
Log:
DAEMON-233: Fix buffer overrun
Modified:
commons/proper/daemon/branches/1.0.x/src/native/windows/src/utils.c
Modified: commons/proper/daemon/branches/1.0.x/src/native/windows/src/utils.c
URL: http://svn.apache.org/viewvc/commons/proper/daemon/branches/1.0.x/src/native/windows/src/utils.c?rev=1239143&r1=1239142&r2=1239143&view=diff
==============================================================================
--- commons/proper/daemon/branches/1.0.x/src/native/windows/src/utils.c (original)
+++ commons/proper/daemon/branches/1.0.x/src/native/windows/src/utils.c Wed Feb 1 14:22:30 2012
@@ -318,7 +318,7 @@ apxMultiSzToArrayW(APXHANDLE hPool, LPCW
*lppArray = (LPWSTR *)buff;
p = (LPWSTR)(buff + (n + 2) * sizeof(LPWSTR));
- AplCopyMemory(p, lpString, (l + 1) * sizeof(WCHAR) + sizeof(WCHAR));
+ AplCopyMemory(p, lpString, (l + 1) * sizeof(WCHAR));
for (i = 0; i < n; i++) {
(*lppArray)[i] = p;
while (*p)
@@ -347,7 +347,7 @@ apxMultiSzToArrayA(APXHANDLE hPool, LPCS
*lppArray = (LPSTR *)buff;
p = (LPSTR)(buff + (n + 2) * sizeof(LPSTR));
- AplCopyMemory(p, lpString, (l + 1) * sizeof(CHAR) + sizeof(CHAR));
+ AplCopyMemory(p, lpString, (l + 1) * sizeof(CHAR));
for (i = 0; i < n; i++) {
(*lppArray)[i] = p;
while (*p)