[NEWDEV]

- Fix buffer overflow in PopulateCustomPathCombo. Powered by DPH.
- Fix a signed vs unsigned comparison

svn path=/trunk/; revision=65154

diff --git a/reactos/dll/win32/newdev/wizard.c b/reactos/dll/win32/newdev/wizard.c
index d3ec237..a903761 100644 (file)
--- a/reactos/dll/win32/newdev/wizard.c
+++ b/reactos/dll/win32/newdev/wizard.c
@@ -280,7 +280,9 @@ PopulateCustomPathCombo(
         TRACE("RegQueryValueEx() failed with error 0x%lx\n", rc);
         goto cleanup;
     }
         TRACE("RegQueryValueEx() failed with error 0x%lx\n", rc);
         goto cleanup;
     }

-    Buffer[dwPathLength] = Buffer[dwPathLength + 1] = '\0';
+
+    Buffer[dwPathLength / sizeof(WCHAR)] = UNICODE_NULL;
+    Buffer[dwPathLength / sizeof(WCHAR) + 1] = UNICODE_NULL;

 
     /* Populate combo box */
     for (Path = Buffer; *Path; Path += wcslen(Path) + 1)
 
     /* Populate combo box */
     for (Path = Buffer; *Path; Path += wcslen(Path) + 1)


@@ -305,7 +307,7 @@ SaveCustomPath(
     LPWSTR Buffer = NULL;
     LPWSTR pBuffer; /* Pointer into Buffer */
     int ItemsCount, Length;
     LPWSTR Buffer = NULL;
     LPWSTR pBuffer; /* Pointer into Buffer */
     int ItemsCount, Length;

-    DWORD i;
+    int i;

     DWORD TotalLength = 0;
     BOOL UseCustomPath = TRUE;
     HKEY hKey = NULL;
     DWORD TotalLength = 0;
     BOOL UseCustomPath = TRUE;
     HKEY hKey = NULL;