From fb2ef53d31e8ff7d1a0d285773b8bce25728f6e6 Mon Sep 17 00:00:00 2001
From: Juan Lang <juan.lang@gmail.com>
Date: Wed, 4 Nov 2009 16:29:33 -0800
Subject: [PATCH] crypt32: Don't copy past end of buffer when removing the last
 string in a multistring.

---
 dlls/crypt32/oid.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/dlls/crypt32/oid.c b/dlls/crypt32/oid.c
index dfa1a678ee..e107bbdea6 100644
--- a/dlls/crypt32/oid.c
+++ b/dlls/crypt32/oid.c
@@ -956,9 +956,18 @@ static BOOL CRYPT_RemoveStringFromMultiString(LPWSTR multi, LPCWSTR toRemove)
     {
         DWORD len = CRYPT_GetMultiStringCharacterLen(multi);
 
-        /* Copy remainder of string "left" */
-        memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
-         (len - (spotToRemove - multi)) * sizeof(WCHAR));
+        if (spotToRemove + lstrlenW(toRemove) + 2 >= multi + len)
+        {
+            /* Removing last string in list, terminate multi string directly */
+            *spotToRemove = 0;
+            *(spotToRemove + 1) = 0;
+        }
+        else
+        {
+            /* Copy remainder of string "left" */
+            memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
+             (len - (spotToRemove - multi)) * sizeof(WCHAR));
+        }
         ret = TRUE;
     }
     else
-- 
2.33.8