Core/CrashHandler: Fix char[] without '\0' handling

Fix char[] without a NULL character '\0' in the array reading over the char[] bounds

(cherry picked from commit fd844e3d7e18212d6e8dd6531eac1f198527926b)

2 files changed, 11 insertions, 5 deletions

diff --git a/src/server/shared/Debugging/WheatyExceptionReport.cpp b/src/server/shared/Debugging/WheatyExceptionReport.cpp
index e9f4f9ca9ac..f8f641a9ea7 100644
--- a/src/server/shared/Debugging/WheatyExceptionReport.cpp
+++ b/src/server/shared/Debugging/WheatyExceptionReport.cpp
@@ -1068,7 +1068,7 @@ bool logChildren)
                 {
                     case btChar:
                     case btStdString:
-                        FormatOutputValue(buffer, basicType, length, (PVOID)offset, sizeof(buffer));
+                        FormatOutputValue(buffer, basicType, length, (PVOID)offset, sizeof(buffer), elementsCount);
                         symbolDetails.top().Value = buffer;
                         break;
                     default:
@@ -1196,7 +1196,8 @@ void WheatyExceptionReport::FormatOutputValue(char * pszCurrBuffer,
 BasicType basicType,
 DWORD64 length,
 PVOID pAddress,
-size_t bufferSize)
+size_t bufferSize,
+size_t countOverride)
 {
     __try
     {
@@ -1204,10 +1205,15 @@ size_t bufferSize)
         {
             case btChar:
             {
-                if (strlen((char*)pAddress) > bufferSize - 6)
+                // Special case handling for char[] type
+                if (countOverride != 0)
+                    length = countOverride;
+                else
+                    length = strlen((char*)pAddress);
+                if (length > bufferSize - 6)
                     pszCurrBuffer += sprintf(pszCurrBuffer, "\"%.*s...\"", bufferSize - 6, (char*)pAddress);
                 else
-                    pszCurrBuffer += sprintf(pszCurrBuffer, "\"%s\"", (char*)pAddress);
+                    pszCurrBuffer += sprintf(pszCurrBuffer, "\"%.*s\"", length, (char*)pAddress);
                 break;
             }
             case btStdString:
diff --git a/src/server/shared/Debugging/WheatyExceptionReport.h b/src/server/shared/Debugging/WheatyExceptionReport.h
index 9137b91aac9..b7731daaa2b 100644
--- a/src/server/shared/Debugging/WheatyExceptionReport.h
+++ b/src/server/shared/Debugging/WheatyExceptionReport.h
@@ -172,7 +172,7 @@ class WheatyExceptionReport
 
         static char * DumpTypeIndex(char *, DWORD64, DWORD, unsigned, DWORD_PTR, bool &, const char*, char*, bool, bool);
 
-        static void FormatOutputValue(char * pszCurrBuffer, BasicType basicType, DWORD64 length, PVOID pAddress, size_t bufferSize);
+        static void FormatOutputValue(char * pszCurrBuffer, BasicType basicType, DWORD64 length, PVOID pAddress, size_t bufferSize, size_t countOverride = 0);
 
         static BasicType GetBasicType(DWORD typeIndex, DWORD64 modBase);
         static DWORD_PTR DereferenceUnsafePointer(DWORD_PTR address);