Fixed #7363: Length checks in ConvertUTF8toUTF16
This commit is contained in:
parent
73fbbcf0fb
commit
623a77258a
@ -584,7 +584,7 @@ ConversionResult ConvertUTF8toUTF16(const BYTE** sourceStart, const BYTE* source
|
||||
|
||||
ch -= offsetsFromUTF8[extraBytesToRead];
|
||||
|
||||
if ((target >= end) && (!computeLength))
|
||||
if ((target * sizeof(WCHAR) >= end) && (!computeLength))
|
||||
{
|
||||
source -= (extraBytesToRead + 1); /* Back up source pointer! */
|
||||
result = targetExhausted;
|
||||
@ -635,7 +635,7 @@ ConversionResult ConvertUTF8toUTF16(const BYTE** sourceStart, const BYTE* source
|
||||
else
|
||||
{
|
||||
/* target is a character in range 0xFFFF - 0x10FFFF. */
|
||||
if ((target + 1 >= end) && (!computeLength))
|
||||
if (((target + 1) * sizeof(WCHAR) >= end) && (!computeLength))
|
||||
{
|
||||
source -= (extraBytesToRead + 1); /* Back up source pointer! */
|
||||
result = targetExhausted;
|
||||
|
Loading…
Reference in New Issue
Block a user