From 161eb5d375fa6f50426258d02921815cc23b2b47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herm=C3=A8s=20B=C3=A9lusca-Ma=C3=AFto?=
 <hermes.belusca-maito@reactos.org>
Date: Mon, 13 Nov 2023 22:37:36 +0100
Subject: [PATCH] [CRT] dbgrpt.cpp: Fix buffer sizes in the *nprintf functions
 (#5678)

Sizes are in number of chars; use _countof() instead of hardcoding
them in the functions.
---
 sdk/lib/crt/misc/dbgrpt.cpp | 41 +++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/sdk/lib/crt/misc/dbgrpt.cpp b/sdk/lib/crt/misc/dbgrpt.cpp
index 51c55af9b4c..a923f666d8a 100644
--- a/sdk/lib/crt/misc/dbgrpt.cpp
+++ b/sdk/lib/crt/misc/dbgrpt.cpp
@@ -133,7 +133,7 @@ HMODULE _CrtGetUser32()
         }
     }
 
-    return _CrtUser32Handle != INVALID_HANDLE_VALUE ? _CrtUser32Handle : NULL;
+    return (_CrtUser32Handle != INVALID_HANDLE_VALUE ? _CrtUser32Handle : NULL);
 }
 
 static tMessageBoxW _CrtGetMessageBox()
@@ -149,7 +149,7 @@ static tMessageBoxW _CrtGetMessageBox()
         _InterlockedCompareExchangePointer((PVOID*)&_CrtMessageBoxW, (PVOID)proc, NULL);
     }
 
-    return _CrtMessageBoxW != INVALID_HANDLE_VALUE ? _CrtMessageBoxW : NULL;
+    return (_CrtMessageBoxW != INVALID_HANDLE_VALUE ? _CrtMessageBoxW : NULL);
 }
 
 
@@ -158,7 +158,7 @@ static int _CrtDbgReportWindow(int reportType, const char_t *filename, int linen
 {
     typedef dbgrpt_char_traits<char_t> traits;
 
-    wchar_t szCompleteMessage[(DBGRPT_MAX_BUFFER_SIZE+1)*2] = {0};
+    wchar_t szCompleteMessage[DBGRPT_MAX_BUFFER_SIZE] = {0};
     wchar_t LineBuffer[20] = {0};
 
     if (filename && !filename[0])
@@ -170,7 +170,8 @@ static int _CrtDbgReportWindow(int reportType, const char_t *filename, int linen
     if (linenumber)
         _itow(linenumber, LineBuffer, 10);
 
-    _snwprintf(szCompleteMessage, DBGRPT_MAX_BUFFER_SIZE * 2,
+    _snwprintf(szCompleteMessage,
+               _countof(szCompleteMessage) - 1,
                traits::szAssertionMessage,
                _CrtModeMessages[reportType],
                moduleName ? L"\nModule: " : L"", moduleName ? moduleName : traits::szEmptyString,
@@ -185,7 +186,7 @@ static int _CrtDbgReportWindow(int reportType, const char_t *filename, int linen
 
     tMessageBoxW messageBox = _CrtGetMessageBox();
     if (!messageBox)
-        return IsDebuggerPresent() ? IDRETRY : IDABORT;
+        return (IsDebuggerPresent() ? IDRETRY : IDABORT);
 
     // TODO: If we are not interacive, add MB_SERVICE_NOTIFICATION
     return messageBox(NULL, szCompleteMessage, L"ReactOS C++ Runtime Library",
@@ -318,8 +319,8 @@ _VCrtDbgReportA(
     const char *format,
     va_list arglist)
 {
-    char szFormatted[DBGRPT_MAX_BUFFER_SIZE+1] = {0};           // The user provided message
-    char szCompleteMessage[(DBGRPT_MAX_BUFFER_SIZE+1)*2] = {0}; // The output for debug / file
+    char szFormatted[DBGRPT_MAX_BUFFER_SIZE] = {0};       // The user provided message
+    char szCompleteMessage[DBGRPT_MAX_BUFFER_SIZE] = {0}; // The output for debug / file
 
     // Check for recursive _CrtDbgReport calls, and validate reportType
     if (!_CrtEnterDbgReport(reportType, filename, linenumber))
@@ -327,12 +328,19 @@ _VCrtDbgReportA(
 
     if (filename)
     {
-        _snprintf(szCompleteMessage, DBGRPT_MAX_BUFFER_SIZE, "%s(%d) : ", filename, linenumber);
+        _snprintf(szCompleteMessage,
+                  _countof(szCompleteMessage) - 1,
+                  "%s(%d) : ",
+                  filename,
+                  linenumber);
     }
 
     if (format)
     {
-        int len = _vsnprintf(szFormatted, DBGRPT_MAX_BUFFER_SIZE - 2 - sizeof(DBGRPT_ASSERT_PREFIX_MESSAGE), format, arglist);
+        int len = _vsnprintf(szFormatted,
+                             _countof(szFormatted) - 2 - _countof(DBGRPT_ASSERT_PREFIX_MESSAGE),
+                             format,
+                             arglist);
         if (len < 0)
         {
             strcpy(szFormatted, DBGRPT_STRING_TOO_LONG);
@@ -373,8 +381,8 @@ _VCrtDbgReportW(
     const wchar_t *format,
     va_list arglist)
 {
-    wchar_t szFormatted[DBGRPT_MAX_BUFFER_SIZE+1] = {0};           // The user provided message
-    wchar_t szCompleteMessage[(DBGRPT_MAX_BUFFER_SIZE+1)*2] = {0}; // The output for debug / file
+    wchar_t szFormatted[DBGRPT_MAX_BUFFER_SIZE] = {0};       // The user provided message
+    wchar_t szCompleteMessage[DBGRPT_MAX_BUFFER_SIZE] = {0}; // The output for debug / file
 
     // Check for recursive _CrtDbgReportW calls, and validate reportType
     if (!_CrtEnterDbgReport(reportType, filename, linenumber))
@@ -382,12 +390,19 @@ _VCrtDbgReportW(
 
     if (filename)
     {
-        _snwprintf(szCompleteMessage, DBGRPT_MAX_BUFFER_SIZE, L"%s(%d) : ", filename, linenumber);
+        _snwprintf(szCompleteMessage,
+                   _countof(szCompleteMessage) - 1,
+                   L"%s(%d) : ",
+                   filename,
+                   linenumber);
     }
 
     if (format)
     {
-        int len = _vsnwprintf(szFormatted, DBGRPT_MAX_BUFFER_SIZE - 2 - sizeof(DBGRPT_ASSERT_PREFIX_MESSAGE), format, arglist);
+        int len = _vsnwprintf(szFormatted,
+                              _countof(szFormatted) - 2 - _countof(DBGRPT_ASSERT_PREFIX_MESSAGE),
+                              format,
+                              arglist);
         if (len < 0)
         {
             wcscpy(szFormatted, _CRT_WIDE(DBGRPT_STRING_TOO_LONG));