]> git.ipfire.org Git - thirdparty/Python/cpython.git/commitdiff
gh-96577: Fixes buffer overrun in _msi module (GH-96633)
authorSteve Dower <steve.dower@python.org>
Wed, 7 Sep 2022 17:01:35 +0000 (18:01 +0100)
committerGitHub <noreply@github.com>
Wed, 7 Sep 2022 17:01:35 +0000 (18:01 +0100)
Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst [new file with mode: 0644]
PC/_msi.c

diff --git a/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
new file mode 100644 (file)
index 0000000..6025e5c
--- /dev/null
@@ -0,0 +1 @@
+Fixes a potential buffer overrun in :mod:`msilib`.
index 3f50f9b88459471edb89cfb91a93e7a8f3e52e88..3686b9bb6f2a6dea2913987eebbe14b1d1fae54e 100644 (file)
--- a/PC/_msi.c
+++ b/PC/_msi.c
@@ -360,7 +360,7 @@ msierror(int status)
     int code;
     char buf[2000];
     char *res = buf;
-    DWORD size = sizeof(buf);
+    DWORD size = Py_ARRAY_LENGTH(buf);
     MSIHANDLE err = MsiGetLastErrorRecord();
 
     if (err == 0) {
@@ -484,7 +484,7 @@ _msi_Record_GetString_impl(msiobj *self, unsigned int field)
     unsigned int status;
     WCHAR buf[2000];
     WCHAR *res = buf;
-    DWORD size = sizeof(buf);
+    DWORD size = Py_ARRAY_LENGTH(buf);
     PyObject* string;
 
     status = MsiRecordGetStringW(self->h, field, res, &size);