resend: http.c: redirect corrections.

[Robert Shearman]

Aric Stewart wrote:

>Index: dlls/wininet/http.c
>===================================================================
>RCS file: /home/wine/wine/dlls/wininet/http.c,v
>retrieving revision 1.113
>diff -u -r1.113 http.c
>--- dlls/wininet/http.c	22 Nov 2005 14:53:30 -0000	1.113
>+++ dlls/wininet/http.c	22 Nov 2005 15:35:24 -0000
>@@ -629,6 +634,26 @@
> 
>     /* We appear to do nothing with the buffer.. is that correct? */
> 
>+    if(!(lpwhr->hdr.dwFlags & INTERNET_FLAG_NO_AUTO_REDIRECT))
>+    {
>+        DWORD dwCode,dwCodeLength=sizeof(DWORD),dwIndex=0;
>+        if(HTTP_HttpQueryInfoW(lpwhr,HTTP_QUERY_FLAG_NUMBER|HTTP_QUERY_STATUS_CODE,&dwCode,&dwCodeLength,&dwIndex) &&
>+            (dwCode==302 || dwCode==301))
>+        {
>+            WCHAR szNewLocation[2048];
>+            DWORD dwBufferSize=2048;
>+            dwIndex=0;
>+            if(HTTP_HttpQueryInfoW(lpwhr,HTTP_QUERY_LOCATION,szNewLocation,&dwBufferSize,&dwIndex))
>+            {
>+	            static const WCHAR szGET[] = { 'G','E','T', 0 };
>+                /* redirects are always GETs */
>+                HeapFree(GetProcessHeap(),0,lpwhr->lpszVerb);
>+	            lpwhr->lpszVerb = WININET_strdupW(szGET);
>+                return HTTP_HandleRedirect(lpwhr, szNewLocation, NULL, 0, NULL, 0);
>+            }
>+        }
>+    }
>+
>     TRACE("%i <--\n",rc);
>     return rc;
> }
>  
>

This proves that HttpSendRequestEx and HttpSendRequest need to share 
more code.

>@@ -1849,13 +1885,26 @@
> #endif
>         
>         HeapFree(GetProcessHeap(), 0, lpwhs->lpszServerName);
>-        lpwhs->lpszServerName = WININET_strdupW(hostName);
>+        if (urlComponents.nPort != INTERNET_DEFAULT_HTTP_PORT &&
>+                urlComponents.nPort != INTERNET_DEFAULT_HTTPS_PORT)
>+        {
>+            int len;
>+            static WCHAR fmt[] = {'%','s',':','%','i',0};
>+            len = lstrlenW(hostName);
>+            len+=6;
>+            lpwhs->lpszServerName = HeapAlloc(GetProcessHeap(),0,len*sizeof(WCHAR));
>  
>

I submitted a patch to unbreak the Host header for proxies that means 
you should be changing lpwhs->lpszHostName now.

>+            sprintfW(lpwhs->lpszServerName,fmt,hostName,urlComponents.nPort);
>+        }
>+        else
>+            lpwhs->lpszServerName = WININET_strdupW(hostName);
>+
>+        HTTP_ProcessHeader(lpwhr, g_szHost, lpwhs->lpszServerName, HTTP_ADDREQ_FLAG_ADD | HTTP_ADDREQ_FLAG_REPLACE | HTTP_ADDHDR_FLAG_REQ);
>+
>+        
>  
>

And you should be sending lpwhs->lpszHostName.

>@@ -1868,6 +1917,9 @@
>             return FALSE;
>         }
> 
>+        if (lstrlenW(extra)>0)
>+            StrCatW(path,extra);
>

Why are you using a shlwapi string function? What's wrong with strcatW 
or lstrcatW?

Also, this could easily cause a buffer overflow by a server sending a 
redirect with a large query. You need to check that there is enough 
space before blinding copying into the buffer.

- 
Rob Shearman