[LOCALMON, LOCALSPL]

Fix a nasty stack corruption due to a *ppwsz[cch] vs. (*ppwsz)[cch] case.
But actually, we don't even need this line for null-terminating the string at all, because we operate on zero-initialized buffers. Remove it in another location as well.

svn path=/branches/colins-printing-for-freedom/; revision=68510

diff --git a/reactos/win32ss/printing/monitors/localmon/tools.c b/reactos/win32ss/printing/monitors/localmon/tools.c
index 3101b89..61e047c 100644 (file)
--- a/reactos/win32ss/printing/monitors/localmon/tools.c
+++ b/reactos/win32ss/printing/monitors/localmon/tools.c
@@ -141,25 +141,26 @@ Cleanup:
 DWORD
 GetPortNameWithoutColon(PCWSTR pwszPortName, PWSTR* ppwszPortNameWithoutColon)
 {
-    DWORD cchPortName;
+    DWORD cchPortNameWithoutColon;
 
     // Compute the string length of pwszPortNameWithoutColon.
-    cchPortName = wcslen(pwszPortName) - 1;
+    cchPortNameWithoutColon = wcslen(pwszPortName) - 1;
 
     // Check if pwszPortName really has a colon as the last character.
-    if (pwszPortName[cchPortName] != L':')
+    if (pwszPortName[cchPortNameWithoutColon] != L':')
         return ERROR_INVALID_PARAMETER;
 
-    // It has, so allocate a buffer and copy the port name without colon into it.
-    *ppwszPortNameWithoutColon = DllAllocSplMem((cchPortName + 1) * sizeof(WCHAR));
+    // Allocate the output buffer.
+    *ppwszPortNameWithoutColon = DllAllocSplMem((cchPortNameWithoutColon + 1) * sizeof(WCHAR));
     if (!*ppwszPortNameWithoutColon)
     {
         ERR("DllAllocSplMem failed with error %lu!\n", GetLastError());
         return ERROR_NOT_ENOUGH_MEMORY;
     }
 
-    CopyMemory(*ppwszPortNameWithoutColon, pwszPortName, cchPortName * sizeof(WCHAR));
-    *ppwszPortNameWithoutColon[cchPortName] = 0;
+    // Copy the port name without colon into the buffer.
+    // The buffer is already zero-initialized, so no additional null-termination is necessary.
+    CopyMemory(*ppwszPortNameWithoutColon, pwszPortName, cchPortNameWithoutColon * sizeof(WCHAR));
 
     return ERROR_SUCCESS;
 }

diff --git a/reactos/win32ss/printing/providers/localspl/printers.c b/reactos/win32ss/printing/providers/localspl/printers.c
index eb27bc8..48540b1 100644 (file)
--- a/reactos/win32ss/printing/providers/localspl/printers.c
+++ b/reactos/win32ss/printing/providers/localspl/printers.c
@@ -579,9 +579,9 @@ LocalOpenPrinter(PWSTR lpPrinterName, HANDLE* phPrinter, PPRINTER_DEFAULTSW pDef
     if (cchFirstParameter)
     {
         // Yes, extract it.
+        // No null-termination is necessary here, because DllAllocSplMem returns a zero-initialized buffer.
         pwszFirstParameter = DllAllocSplMem((cchFirstParameter + 1) * sizeof(WCHAR));
         CopyMemory(pwszFirstParameter, lpPrinterName, cchFirstParameter * sizeof(WCHAR));
-        pwszFirstParameter[cchFirstParameter] = 0;
     }
 
     // Do we have a second parameter?