Nikolay Sivov : xmllite/reader: Fix writing back resolved character reference value.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 107615da7f07cfbc69c8f23c3c416c60fc27a9c8
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=107615da7f07cfbc69c8f23c3c416c60fc27a9c8

Author: Nikolay Sivov <nsivov at codeweavers.com>
Date:   Fri Mar  3 00:11:28 2017 +0300

xmllite/reader: Fix writing back resolved character reference value.

Signed-off-by: Nikolay Sivov <nsivov at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/xmllite/reader.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/dlls/xmllite/reader.c b/dlls/xmllite/reader.c
index 9bb0d56..a880bee 100644
--- a/dlls/xmllite/reader.c
+++ b/dlls/xmllite/reader.c
@@ -2054,8 +2054,12 @@ static HRESULT reader_parse_reference(xmlreader *reader)
         /* normalize */
         if (is_wchar_space(ch)) ch = ' ';
 
-        len = buffer->written - ((char*)ptr - buffer->data) - sizeof(WCHAR);
-        memmove(start+1, ptr+1, len);
+        ptr = reader_get_ptr(reader);
+        start = reader_get_ptr2(reader, cur);
+        len = buffer->written - ((char *)ptr - buffer->data);
+        memmove(start + 1, ptr + 1, len);
+
+        buffer->written -= (reader_get_cur(reader) - cur) * sizeof(WCHAR);
         buffer->cur = cur + 1;
 
         *start = ch;