From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Tue, 4 Oct 2022 18:07:09 +0000 (-0700)
Subject: [3.8] gh-96577: Fixes buffer overrun in _msi module (GH-96633) (GH-96658)
X-Git-Tag: v3.8.15~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=12c72d684d43bf87e8457fd0190343daf01db23d;p=thirdparty%2FPython%2Fcpython.git

[3.8] gh-96577: Fixes buffer overrun in _msi module (GH-96633) (GH-96658)

gh-96577: Fixes buffer overrun in _msi module (GH-96633)
(cherry picked from commit 4114bcc9ef7595a07196bcecf9c7d6d39f57f64d)

Co-authored-by: Steve Dower <steve.dower@python.org>
---

diff --git a/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
new file mode 100644
index 000000000000..6025e5ce4130
--- /dev/null
+++ b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
@@ -0,0 +1 @@
+Fixes a potential buffer overrun in :mod:`msilib`.
diff --git a/PC/_msi.c b/PC/_msi.c
index 5079a524646f..0b92712233c9 100644
--- a/PC/_msi.c
+++ b/PC/_msi.c
@@ -292,7 +292,7 @@ msierror(int status)
     int code;
     char buf[2000];
     char *res = buf;
-    DWORD size = sizeof(buf);
+    DWORD size = Py_ARRAY_LENGTH(buf);
     MSIHANDLE err = MsiGetLastErrorRecord();
 
     if (err == 0) {
@@ -386,7 +386,7 @@ record_getstring(msiobj* record, PyObject* args)
     unsigned int status;
     WCHAR buf[2000];
     WCHAR *res = buf;
-    DWORD size = sizeof(buf);
+    DWORD size = Py_ARRAY_LENGTH(buf);
     PyObject* string;
 
     if (!PyArg_ParseTuple(args, "I:GetString", &field))