diff --git a/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst new file mode 100644 index 0000000000000000000000000000000000000000..6025e5ce4130426c32e95b5b8159d57017b63efe --- /dev/null +++ b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst @@ -0,0 +1 @@ +Fixes a potential buffer overrun in :mod:`msilib`. diff --git a/PC/_msi.c b/PC/_msi.c index 01516e85ccff30b4839ca111b48bb417dbd5e057..3d4e4ef22c26ddf0fe9de2da1a6e95e0df574f95 100644 --- a/PC/_msi.c +++ b/PC/_msi.c @@ -360,7 +360,7 @@ msierror(int status) int code; char buf[2000]; char *res = buf; - DWORD size = sizeof(buf); + DWORD size = Py_ARRAY_LENGTH(buf); MSIHANDLE err = MsiGetLastErrorRecord(); if (err == 0) { @@ -484,7 +484,7 @@ _msi_Record_GetString_impl(msiobj *self, unsigned int field) unsigned int status; WCHAR buf[2000]; WCHAR *res = buf; - DWORD size = sizeof(buf); + DWORD size = Py_ARRAY_LENGTH(buf); PyObject* string; status = MsiRecordGetStringW(self->h, field, res, &size);