Commit a0aaa655 authored by Andrew Eikum's avatar Andrew Eikum Committed by Alexandre Julliard

ole32: Don't read past the end of the stream when converting block types.

parent bfe83b22
...@@ -3563,7 +3563,7 @@ BlockChainStream* Storage32Impl_SmallBlocksToBigBlocks( ...@@ -3563,7 +3563,7 @@ BlockChainStream* Storage32Impl_SmallBlocksToBigBlocks(
{ {
resRead = SmallBlockChainStream_ReadAt(*ppsbChain, resRead = SmallBlockChainStream_ReadAt(*ppsbChain,
offset, offset,
This->smallBlockSize, min(This->smallBlockSize, size.u.LowPart - offset.u.LowPart),
buffer, buffer,
&cbRead); &cbRead);
if (FAILED(resRead)) if (FAILED(resRead))
...@@ -3582,7 +3582,7 @@ BlockChainStream* Storage32Impl_SmallBlocksToBigBlocks( ...@@ -3582,7 +3582,7 @@ BlockChainStream* Storage32Impl_SmallBlocksToBigBlocks(
if (FAILED(resWrite)) if (FAILED(resWrite))
break; break;
offset.u.LowPart += This->smallBlockSize; offset.u.LowPart += cbRead;
} }
} while (cbTotalRead.QuadPart < size.QuadPart); } while (cbTotalRead.QuadPart < size.QuadPart);
HeapFree(GetProcessHeap(),0,buffer); HeapFree(GetProcessHeap(),0,buffer);
...@@ -3663,7 +3663,8 @@ SmallBlockChainStream* Storage32Impl_BigBlocksToSmallBlocks( ...@@ -3663,7 +3663,8 @@ SmallBlockChainStream* Storage32Impl_BigBlocksToSmallBlocks(
do do
{ {
resRead = BlockChainStream_ReadAt(*ppbbChain, offset, resRead = BlockChainStream_ReadAt(*ppbbChain, offset,
This->bigBlockSize, buffer, &cbRead); min(This->bigBlockSize, size.u.LowPart - offset.u.LowPart),
buffer, &cbRead);
if(FAILED(resRead)) if(FAILED(resRead))
break; break;
...@@ -3678,7 +3679,7 @@ SmallBlockChainStream* Storage32Impl_BigBlocksToSmallBlocks( ...@@ -3678,7 +3679,7 @@ SmallBlockChainStream* Storage32Impl_BigBlocksToSmallBlocks(
if(FAILED(resWrite)) if(FAILED(resWrite))
break; break;
offset.u.LowPart += This->bigBlockSize; offset.u.LowPart += cbRead;
} }
}while(cbTotalRead.QuadPart < size.QuadPart); }while(cbTotalRead.QuadPart < size.QuadPart);
HeapFree(GetProcessHeap(), 0, buffer); HeapFree(GetProcessHeap(), 0, buffer);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment