From 3f465430af19d730b3be87b97dbb306563dc990a Mon Sep 17 00:00:00 2001
From: midipix <writeonce@midipix.org>
Date: Tue, 23 Jan 2024 06:07:47 +0000
Subject: __ntapi_tt_array_convert_utf8_to_utf16(): outer loop: boundary
 checking.

---
 src/argv/ntapi_tt_array_utf8.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/argv')

diff --git a/src/argv/ntapi_tt_array_utf8.c b/src/argv/ntapi_tt_array_utf8.c
index ed8dd9a..e19ad43 100644
--- a/src/argv/ntapi_tt_array_utf8.c
+++ b/src/argv/ntapi_tt_array_utf8.c
@@ -307,7 +307,7 @@ int32_t __stdcall __ntapi_tt_array_convert_utf8_to_utf16(
 	ubound--;
 	ubound--;
 
-	for (; arrv && *arrv; arrv++,warrv++) {
+	for (; arrv && *arrv && (wch<ubound); arrv++,warrv++) {
 		*warrv = wch - wdiff;
 		ch     = *arrv + diff;
 
@@ -385,6 +385,9 @@ int32_t __stdcall __ntapi_tt_array_convert_utf8_to_utf16(
 		*wch++ = 0;
 	}
 
+	if (wch == ubound)
+		return NT_STATUS_BUFFER_TOO_SMALL;
+
 	*wch++ = 0;
 	*warrv = 0;
 	*bytes_written = sizeof(wchar16_t) * (wch - buffer);
-- 
cgit v1.2.3