From 938223e8d1eabdd6a73531a8dd52407ef23f6375 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Tue, 4 Oct 2022 10:06:17 -0700 Subject: [PATCH] [3.9] gh-96577: Fixes buffer overrun in _msi module (GH-96633) (GH-96657) gh-96577: Fixes buffer overrun in _msi module (GH-96633) (cherry picked from commit 4114bcc9ef7595a07196bcecf9c7d6d39f57f64d) Co-authored-by: Steve Dower --- .../Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst | 1 + PC/_msi.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst diff --git a/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst new file mode 100644 index 00000000000000..6025e5ce413042 --- /dev/null +++ b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst @@ -0,0 +1 @@ +Fixes a potential buffer overrun in :mod:`msilib`. diff --git a/PC/_msi.c b/PC/_msi.c index 913d3b85abb5f5..fd68e1df07f7eb 100644 --- a/PC/_msi.c +++ b/PC/_msi.c @@ -292,7 +292,7 @@ msierror(int status) int code; char buf[2000]; char *res = buf; - DWORD size = sizeof(buf); + DWORD size = Py_ARRAY_LENGTH(buf); MSIHANDLE err = MsiGetLastErrorRecord(); if (err == 0) { @@ -386,7 +386,7 @@ record_getstring(msiobj* record, PyObject* args) unsigned int status; WCHAR buf[2000]; WCHAR *res = buf; - DWORD size = sizeof(buf); + DWORD size = Py_ARRAY_LENGTH(buf); PyObject* string; if (!PyArg_ParseTuple(args, "I:GetString", &field))