Patch olestring-binary-safe for COM related Bug #63208

Patch version 2015-08-16 16:26 UTC

• 2015-08-16 16:26 UTC [diff to current]

Developer: cmb@php.net

 ext/com_dotnet/com_olechar.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ext/com_dotnet/com_olechar.c b/ext/com_dotnet/com_olechar.c
index 259d80b..f9da81f 100644
--- a/ext/com_dotnet/com_olechar.c
+++ b/ext/com_dotnet/com_olechar.c
@@ -76,12 +76,13 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring, size_t
 	char *string;
 	uint length = 0;
 	BOOL ok;
+	DWORD char_count = *((DWORD *) olestring - 1) / sizeof(OLECHAR) + 1;
 
-	length = WideCharToMultiByte(codepage, 0, olestring, -1, NULL, 0, NULL, NULL);
+	length = WideCharToMultiByte(codepage, 0, olestring, char_count, NULL, 0, NULL, NULL);
 
 	if (length) {
 		string = (char*)safe_emalloc(length, sizeof(char), 0);
-		length = WideCharToMultiByte(codepage, 0, olestring, -1, string, length, NULL, NULL);
+		length = WideCharToMultiByte(codepage, 0, olestring, char_count, string, length, NULL, NULL);
 		ok = length > 0;
 	} else {
 		string = (char*)emalloc(sizeof(char));