Re: c dll calling vb dll

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Igor Tandetnik (itandetnik_at_mvps.org)
Date: 08/05/04 

Date: Thu, 5 Aug 2004 11:30:04 -0400

"ch5082" <ch5082@discussions.microsoft.com> wrote in message
news:3875C954-5364-4B2D-AC69-B50FF3DF9FEE@microsoft.com
> I'm having problems with the variable initialization. The strings
> I'm passing back always seem to have the value I'm expecting plus a
> bunch of junk. Here's what I'm doing now. [code]
>
> BSTR sName=NULL;
> BSTR sDomain=NULL;
>
> if(g_oObjPtr->GetPlan(&sName,&sDomain))
> {
>
>
WideCharToMultiByte(CP_ACP,NULL,sName,SysStringLen(sName),sPlanName_out,
SysStringLen(sName)+1,NULL,NULL);
>
WideCharToMultiByte(CP_ACP,NULL,sDomain,SysStringLen(sDomain),sPlanDomai
n_out,SysStringLen(sDomain)+1,NULL,NULL);

SysStringLen does not account for the terminating NUL character. When
you tell WideCharToMultiByte to convert a buffer that does not have a
terminating NUL, it does not write NUL into the output either. So your
char* strings end up not being NUL-terminated.

Another issue - you tell WideCharToMultiByte that the destination buffer
is at least SysStringLen(sName)+1 bytes large. How do you know that?
There is no indication that the caller-provided buffer is large enough.
This code is asking for a buffer overrun. 

-- 
With best wishes,
    Igor Tandetnik
"For every complex problem, there is a solution that is simple, neat,
and wrong." H.L. Mencken

Relevant Pages

  • Re: [Lit.] Buffer overruns
    ... >> As has been pointed out, C strings are unrelated to C buffer overflow ... > is a infrastructure source length available based on nul-terminated, ... > data-pattern based length paradigm ... ...
    (sci.crypt)
  • Re: null terminated strings
    ... terminated strings are blamed because they were being used in the programs ... involved with the overrun situation. ... maximum length for that buffer and make sure you don't exceed it. ... Languages such as COBOL would automaically pad or truncate fields during ...
    (comp.os.vms)
  • Re: [Lit.] Buffer overruns
    ... > As has been pointed out, C strings are unrelated to C buffer overflow ... is a infrastructure source length available based on nul-terminated, ... data-pattern based length paradigm ... ...
    (sci.crypt)
  • Re: String concatenation function, request for comments.
    ... usefulness, efficiency, and most importantly the correctness of this small piece of code. ... as the responsibility of freeing the memory would be left to the client. ... If the resultant buffer is needed beyond the second call to the function, it can be copied to another buffer at the clients digression. ... If the strings specified for concatenation exceed the buffer available, ...
    (comp.lang.c)
  • Re: String concatenation function, request for comments.
    ... >> left to the client. ... If the resultant buffer is needed beyond the second ... >> If the strings specified for concatenation exceed the buffer available, ... > This demonstrates a fragility of the interface. ...
    (comp.lang.c)