From 938223e8d1eabdd6a73531a8dd52407ef23f6375 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
<31488909+miss-islington@users.noreply.github.com>
Date: Tue, 4 Oct 2022 10:06:17 -0700
Subject: [PATCH] [3.9] gh-96577: Fixes buffer overrun in _msi module
(GH-96633) (GH-96657)
gh-96577: Fixes buffer overrun in _msi module (GH-96633)
(cherry picked from commit 4114bcc9ef7595a07196bcecf9c7d6d39f57f64d)
Co-authored-by: Steve Dower <steve.dower@python.org>
---
.../Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst | 1 +
PC/_msi.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
create mode 100644 Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
diff --git a/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
new file mode 100644
index 00000000000..6025e5ce413
--- /dev/null
+++ b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
@@ -0,0 +1 @@
+Fixes a potential buffer overrun in :mod:`msilib`.
diff --git a/PC/_msi.c b/PC/_msi.c
index 913d3b85abb..fd68e1df07f 100644
--- a/PC/_msi.c
+++ b/PC/_msi.c
@@ -292,7 +292,7 @@ msierror(int status)
int code;
char buf[2000];
char *res = buf;
- DWORD size = sizeof(buf);
+ DWORD size = Py_ARRAY_LENGTH(buf);
MSIHANDLE err = MsiGetLastErrorRecord();
if (err == 0) {
@@ -386,7 +386,7 @@ record_getstring(msiobj* record, PyObject* args)
unsigned int status;
WCHAR buf[2000];
WCHAR *res = buf;
- DWORD size = sizeof(buf);
+ DWORD size = Py_ARRAY_LENGTH(buf);
PyObject* string;
if (!PyArg_ParseTuple(args, "I:GetString", &field))
--
GitLab