Marcus Meissner : wininet: Fixed memory corruption in urlcache.
Alexandre Julliard
julliard at winehq.org
Mon Apr 6 09:00:32 CDT 2009
Module: wine
Branch: master
Commit: cb80692cf86ef133a75d47b569568b43caee59a3
URL: http://source.winehq.org/git/wine.git/?a=commit;h=cb80692cf86ef133a75d47b569568b43caee59a3
Author: Marcus Meissner <marcus at jet.franken.de>
Date: Sun Apr 5 13:55:21 2009 +0200
wininet: Fixed memory corruption in urlcache.
---
dlls/wininet/urlcache.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/dlls/wininet/urlcache.c b/dlls/wininet/urlcache.c
index bf67fec..b4feba3 100644
--- a/dlls/wininet/urlcache.c
+++ b/dlls/wininet/urlcache.c
@@ -995,11 +995,13 @@ static DWORD URLCache_CopyEntry(
/* FIXME: is source url optional? */
if (*lpdwBufferSize >= dwRequiredSize)
{
- lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrl - 1;
+ DWORD lenUrlBytes = (lenUrl+1) * (bUnicode ? sizeof(WCHAR) : sizeof(CHAR));
+
+ lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrlBytes;
if (bUnicode)
MultiByteToWideChar(CP_ACP, 0, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, -1, (LPWSTR)lpCacheEntryInfo->lpszSourceUrlName, lenUrl + 1);
else
- memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, (lenUrl + 1) * sizeof(CHAR));
+ memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, lenUrlBytes);
}
if ((dwRequiredSize % 4) && (dwRequiredSize < *lpdwBufferSize))
More information about the wine-cvs
mailing list