bpo-9194: Fix the bounds checking in winreg.c's fixupMultiSZ() (GH-12687) (GH-12910)

miss-islington · ZackerySpytz · ned-deily · commit dadc34784444 · 2019-05-02T12:00:33.000-04:00
(cherry picked from commit 56ed864) Co-authored-by: Zackery Spytz <zspytz@gmail.com>
diff --git a/PC/winreg.c b/PC/winreg.c
@@ -520,7 +520,7 @@ fixupMultiSZ(wchar_t **str, wchar_t *data, int len)
     Q = data + len;
     for (P = data, i = 0; P < Q && *P != '\0'; P++, i++) {
         str[i] = P;
-        for(; *P != '\0'; P++)
+        for (; P < Q && *P != '\0'; P++)
             ;
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -520,7 +520,7 @@ fixupMultiSZ(wchar_t *str, wchar_t data, int len)`
`520`	`520`	`Q = data + len;`
`521`	`521`	`for (P = data, i = 0; P < Q && *P != '\0'; P++, i++) {`
`522`	`522`	`str[i] = P;`
`523`		`- for(; *P != '\0'; P++)`
	`523`	`+ for (; P < Q && *P != '\0'; P++)`
`524`	`524`	`;`
`525`	`525`	`}`
`526`	`526`	`}`