[Python-checkins] gh-96577: Fixes buffer overrun in _msi module (GH-96633)

[miss-islington]

https://github.com/python/cpython/commit/9fa21d050abf5ba2b39762e320cb6e6bb8b905c2
commit: 9fa21d050abf5ba2b39762e320cb6e6bb8b905c2
branch: 3.11
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: miss-islington <31488909+miss-islington at users.noreply.github.com>
date: 2022-09-07T12:46:09-07:00
summary:

gh-96577: Fixes buffer overrun in _msi module (GH-96633)

(cherry picked from commit 4114bcc9ef7595a07196bcecf9c7d6d39f57f64d)

Co-authored-by: Steve Dower <steve.dower at python.org>

files:
A Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
M PC/_msi.c

diff --git a/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
new file mode 100644
index 00000000000..6025e5ce413
--- /dev/null
+++ b/Misc/NEWS.d/next/Windows/2022-09-07-00-11-33.gh-issue-96577.kV4K_1.rst
@@ -0,0 +1 @@
+Fixes a potential buffer overrun in :mod:`msilib`.
diff --git a/PC/_msi.c b/PC/_msi.c
index 01516e85ccf..3d4e4ef22c2 100644
--- a/PC/_msi.c
+++ b/PC/_msi.c
@@ -360,7 +360,7 @@ msierror(int status)
     int code;
     char buf[2000];
     char *res = buf;
-    DWORD size = sizeof(buf);
+    DWORD size = Py_ARRAY_LENGTH(buf);
     MSIHANDLE err = MsiGetLastErrorRecord();
 
     if (err == 0) {
@@ -484,7 +484,7 @@ _msi_Record_GetString_impl(msiobj *self, unsigned int field)
     unsigned int status;
     WCHAR buf[2000];
     WCHAR *res = buf;
-    DWORD size = sizeof(buf);
+    DWORD size = Py_ARRAY_LENGTH(buf);
     PyObject* string;
 
     status = MsiRecordGetStringW(self->h, field, res, &size);