Pengpeng Dong : conhost: Validate width param in write_output.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: b9f1ec8c44ebe62b4005d4ea2cfd63f700ea8a17
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=b9f1ec8c44ebe62b4005d4ea2cfd63f700ea8a17

Author: Pengpeng Dong <dongpengpeng at uniontech.com>
Date:   Wed Sep 23 15:04:39 2020 +0200

conhost: Validate width param in write_output.

Signed-off-by: Pengpeng Dong <dongpengpeng at uniontech.com>
Signed-off-by: Jacek Caban <jacek at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 programs/conhost/conhost.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/programs/conhost/conhost.c b/programs/conhost/conhost.c
index 79cbb8e83a..ed52838528 100644
--- a/programs/conhost/conhost.c
+++ b/programs/conhost/conhost.c
@@ -1984,6 +1984,8 @@ static NTSTATUS write_output( struct screen_buffer *screen_buffer, const struct
     char_info_t *dest;
     char *src;
 
+    if (*out_size == sizeof(SMALL_RECT) && !params->width) return STATUS_INVALID_PARAMETER;
+
     entry_size = params->mode == CHAR_INFO_MODE_TEXTATTR ? sizeof(char_info_t) : sizeof(WCHAR);
     entry_cnt = (in_size - sizeof(*params)) / entry_size;