Fix a buffer overflow in OutputDebugStringA. Spotted by mbealby@gmail.com.

svn path=/trunk/; revision=20008

diff --git a/reactos/lib/kernel32/debug/output.c b/reactos/lib/kernel32/debug/output.c
index abe7cb6..0a06a84 100644 (file)
--- a/reactos/lib/kernel32/debug/output.c
+++ b/reactos/lib/kernel32/debug/output.c
@@ -397,10 +397,10 @@ VOID WINAPI OutputDebugStringA(LPCSTR _OutputString)
        nRoundLen = nOutputStringLen;
 
       /* copy the current block into the buffer */
        nRoundLen = nOutputStringLen;
 
       /* copy the current block into the buffer */

-      memcpy(pDBMonBuffer->Buffer, _OutputString, nOutputStringLen);
+      memcpy(pDBMonBuffer->Buffer, _OutputString, nRoundLen);

 
       /* null-terminate the current block */
 
       /* null-terminate the current block */

-      pDBMonBuffer->Buffer[nOutputStringLen] = 0;
+      pDBMonBuffer->Buffer[nRoundLen] = 0;

 
       /* signal that the data contains meaningful data and can be read */
       SetEvent(hDBMonDataReady);
 
       /* signal that the data contains meaningful data and can be read */
       SetEvent(hDBMonDataReady);