stringw(): Fixed handling of invalid input 16-bit wstrings

diff --git a/ntoskrnl/rtl/sprintf.c b/ntoskrnl/rtl/sprintf.c
index ca26c98..770c0e9 100644 (file)
--- a/ntoskrnl/rtl/sprintf.c
+++ b/ntoskrnl/rtl/sprintf.c
@@ -228,7 +228,15 @@ stringw(char* buf, char* end, const wchar_t* sw, int len, int field_width, int p
        for (i = 0; i < len; ++i)
        {
                if (buf <= end)
+               {
                        *buf = (unsigned char)(*sw++);
+                       /* Although (wchar_t)[*sw] may be nonzero the resulting (unsigned char)
+                        * becomes string terminator - we must terminate at that point
+                        * to return the correct (unsigned char)-based string end pointer 'buf'.
+                        */
+                       if (!*buf)
+                               break;
+               }
                ++buf;
        }
        while (len < field_width--)