From: rbencina <rbencina@0f58301d-fd10-0410-b4af-bbb618454e57>
Date: Wed, 21 Jan 2015 06:52:11 +0000 (+0000)
Subject: pa/wmme: avoid potential (but highly unlikely) overflow in buffer size in call to... 
X-Git-Tag: pa_stable_v190600_20161030~41
X-Git-Url: https://andrewgundersen.net/repos?a=commitdiff_plain;h=039bc21bda426964ae396f0a5965d0ec07b2a08b;p=portaudio

pa/wmme: avoid potential (but highly unlikely) overflow in buffer size in call to WideCharToMultiByte if a device name length exceeds INT_MAX. should also fix compiler warning about size_t to int assignment.
---

diff --git a/src/hostapi/wmme/pa_win_wmme.c b/src/hostapi/wmme/pa_win_wmme.c
index 2fb2d49..422c867 100644
--- a/src/hostapi/wmme/pa_win_wmme.c
+++ b/src/hostapi/wmme/pa_win_wmme.c
@@ -86,6 +86,7 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <limits.h>
 #include <math.h>
 #include <windows.h>
 #include <mmsystem.h>
@@ -218,7 +219,22 @@ static char *CopyTCharStringToUtf8CString(char *destination, size_t destLengthBy
     Source: WideCharToMultiByte at MSDN:
     http://msdn.microsoft.com/en-us/library/windows/desktop/dd374130(v=vs.85).aspx
     */
-    if (WideCharToMultiByte(CP_UTF8, 0, source, -1, destination, (int)destLengthBytes, NULL, NULL) == 0)
+    int intDestLengthBytes; /* cbMultiByte */
+    /* intDestLengthBytes is an int, destLengthBytes is a size_t. Ensure that we don't overflow
+    intDestLengthBytes by only using at most INT_MAX bytes of destination buffer.
+    */
+    if (destLengthBytes < INT_MAX)
+    {
+#pragma warning (disable : 4267) /* "conversion from 'size_t' to 'int', possible loss of data" */
+        intDestLengthBytes = (int)destLengthBytes; /* destLengthBytes is guaranteed < INT_MAX here */
+#pragma warning (default : 4267)
+    }
+    else
+    {
+        intDestLengthBytes = INT_MAX;
+    }
+    
+    if (WideCharToMultiByte(CP_UTF8, 0, source, -1, destination, /*cbMultiByte=*/intDestLengthBytes, NULL, NULL) == 0)
         return NULL;
     return destination;
 #endif