fixed misuse of realloc

if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.
This commit is contained in:
Frank Morgner
2019-01-17 15:04:35 +01:00
parent 3209ef2261
commit c63cc40c34
6 changed files with 44 additions and 32 deletions

View File

@@ -11,14 +11,16 @@ bool getBuffer(IWDFIoRequest* pRequest,void **buffer,int *bufferLen) {
else {
SIZE_T size;
void *data=inmem->GetDataBuffer(&size);
void *out = realloc(*buffer, size);
if (out==NULL) {
OutputDebugString(L"realloc failed");
return false;
if (0 != size) {
void *out = realloc(*buffer, size);
if (out==NULL) {
OutputDebugString(L"realloc failed");
return false;
}
memcpy(out,data,size);
(*buffer)=out;
}
memcpy(out,data,size);
(*bufferLen)=(int)size;
(*buffer)=out;
inmem->Release();
return true;
}