smartcard: Fix length of output buffer in device control response
@@ -702,12 +702,14 @@ static LONG smartcard_ListReadersW_Call(SMARTCARD_DEVICE* smartcard, SMARTCARD_O
DWORD cchReaders = 0;
IRP* irp = operation->irp;
ListReaders_Call* call = &operation->call.listReaders;
- union {
+ union
+ {
const BYTE* bp;
const char* sz;
const WCHAR* wz;
} string;
- union {
+ union
+ {
WCHAR** ppw;
WCHAR* pw;
CHAR* pc;
@@ -2686,7 +2688,7 @@ LONG smartcard_irp_device_control_call(SMARTCARD_DEVICE* smartcard, SMARTCARD_OP
Stream_SealLength(irp->output);
outputBufferLength = Stream_Length(irp->output);
WINPR_ASSERT(outputBufferLength >= RDPDR_DEVICE_IO_RESPONSE_LENGTH - 4U);
- outputBufferLength -= RDPDR_DEVICE_IO_RESPONSE_LENGTH - 4U;
+ outputBufferLength -= (RDPDR_DEVICE_IO_RESPONSE_LENGTH + 4U);
WINPR_ASSERT(outputBufferLength >= RDPDR_DEVICE_IO_RESPONSE_LENGTH);
objectBufferLength = outputBufferLength - RDPDR_DEVICE_IO_RESPONSE_LENGTH;
WINPR_ASSERT(outputBufferLength <= UINT32_MAX);
