Hans Leidekker : wininet: Avoid a crash on NULL lpcszHeader in HttpSendRequestExW.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 4990ca0ea342bd115a9a46047b3b2de599cb916e
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=4990ca0ea342bd115a9a46047b3b2de599cb916e

Author: Hans Leidekker <hans at codeweavers.com>
Date:   Tue Nov 17 15:59:52 2009 +0100

wininet: Avoid a crash on NULL lpcszHeader in HttpSendRequestExW.

---

 dlls/wininet/http.c |   20 ++++++++++++--------
 1 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c
index 1426439..3603761 100644
--- a/dlls/wininet/http.c
+++ b/dlls/wininet/http.c
@@ -3338,17 +3338,21 @@ BOOL WINAPI HttpSendRequestExW(HINTERNET hRequest,
         req = &workRequest.u.HttpSendRequestW;
         if (lpBuffersIn)
         {
-            DWORD size;
+            DWORD size = 0;
 
-            if (lpBuffersIn->dwHeadersLength == ~0u)
-                size = (strlenW( lpBuffersIn->lpcszHeader ) + 1) * sizeof(WCHAR);
-            else
-                size = lpBuffersIn->dwHeadersLength * sizeof(WCHAR);
+            if (lpBuffersIn->lpcszHeader)
+            {
+                if (lpBuffersIn->dwHeadersLength == ~0u)
+                    size = (strlenW( lpBuffersIn->lpcszHeader ) + 1) * sizeof(WCHAR);
+                else
+                    size = lpBuffersIn->dwHeadersLength * sizeof(WCHAR);
 
-            req->lpszHeader = HeapAlloc( GetProcessHeap(), 0, size );
-            memcpy( req->lpszHeader, lpBuffersIn->lpcszHeader, size );
+                req->lpszHeader = HeapAlloc( GetProcessHeap(), 0, size );
+                memcpy( req->lpszHeader, lpBuffersIn->lpcszHeader, size );
+            }
+            else req->lpszHeader = NULL;
 
-            req->dwHeaderLength = lpBuffersIn->dwHeadersLength;
+            req->dwHeaderLength = size / sizeof(WCHAR);
             req->lpOptional = lpBuffersIn->lpvBuffer;
             req->dwOptionalLength = lpBuffersIn->dwBufferLength;
             req->dwContentLength = lpBuffersIn->dwBufferTotal;