X-Git-Url: https://git.reactos.org/?p=reactos.git;a=blobdiff_plain;f=base%2Fservices%2Ftcpsvcs%2Flog.c;h=3b2d467d712dd695cae534fffcb47a79e42cfe86;hp=6b117244993c564b777394c36fb1238a73a4dd09;hb=cf77354dceaa68dbcdf0713a3a0db8a170a1f881;hpb=ecfd6e6d6ddf7bcebb906b629c120d996b87ea8d

diff --git a/base/services/tcpsvcs/log.c b/base/services/tcpsvcs/log.c
index 6b117244993..3b2d467d712 100644
--- a/base/services/tcpsvcs/log.c
+++ b/base/services/tcpsvcs/log.c
@@ -1,7 +1,7 @@
 /*
  * PROJECT:     ReactOS simple TCP/IP services
  * LICENSE:     GPL - See COPYING in the top level directory
- * FILE:        /base/services/tcpsvcs/log.c
+ * FILE:        base/services/tcpsvcs/log.c
  * PURPOSE:     Logging functionality for the service
  * COPYRIGHT:   Copyright 2008 Ged Murphy <gedmurphy@reactos.org>
  *
@@ -70,20 +70,20 @@ LogToFile(LPCWSTR lpMsg,
           UINT flags)
 {
     LPWSTR lpFullMsg = NULL;
-    DWORD msgLen;
+    SIZE_T msgLen;
 
     msgLen = wcslen(lpMsg) + 1;
 
     if (flags & LOG_ERROR)
     {
-        LPVOID lpSysMsg;
+        LPWSTR lpSysMsg;
         DWORD eMsgLen;
 
         eMsgLen = FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
                                  NULL,
                                  errNum,
                                  MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-                                 (LPTSTR)&lpSysMsg,
+                                 (LPWSTR)&lpSysMsg,
                                  0,
                                  NULL);
 
@@ -122,6 +122,13 @@ LogToFile(LPCWSTR lpMsg,
         }
     }
 
+    /* Make sure the length in bytes doesn't overflow a DWORD */
+    msgLen = wcslen(lpFullMsg);
+    if (msgLen > (MAXDWORD / sizeof(WCHAR)))
+    {
+        RaiseException(EXCEPTION_INT_OVERFLOW, 0, 0, NULL);
+    }
+
     if (lpFullMsg)
     {
         DWORD bytesWritten;
@@ -130,7 +137,7 @@ LogToFile(LPCWSTR lpMsg,
 
         bRet = WriteFile(hLogFile,
                          lpFullMsg,
-                         wcslen(lpFullMsg) * sizeof(WCHAR),
+                         (DWORD)msgLen * sizeof(WCHAR),
                          &bytesWritten,
                          &olWrite);
         if (!bRet)