Jacek Caban : xmllite: Fixed buffer handling in reader_parse_reference.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: a3d78064d981ca4e1fa3d0ebe2adcbccdb9a8cce
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=a3d78064d981ca4e1fa3d0ebe2adcbccdb9a8cce

Author: Jacek Caban <jacek at codeweavers.com>
Date:   Mon Mar 20 14:01:11 2017 +0100

xmllite: Fixed buffer handling in reader_parse_reference.

Signed-off-by: Jacek Caban <jacek at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/xmllite/reader.c       |  1 +
 dlls/xmllite/tests/reader.c | 10 +++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/dlls/xmllite/reader.c b/dlls/xmllite/reader.c
index 7c9f76a..c33d9bf 100644
--- a/dlls/xmllite/reader.c
+++ b/dlls/xmllite/reader.c
@@ -2122,6 +2122,7 @@ static HRESULT reader_parse_reference(xmlreader *reader)
             len = buffer->written - ((char*)ptr - buffer->data) - sizeof(WCHAR);
             memmove(start+1, ptr+1, len);
             buffer->cur = cur + 1;
+            buffer->written -= (ptr - start) * sizeof(WCHAR);
 
             *start = ch;
         }
diff --git a/dlls/xmllite/tests/reader.c b/dlls/xmllite/tests/reader.c
index c710894..47192f9 100644
--- a/dlls/xmllite/tests/reader.c
+++ b/dlls/xmllite/tests/reader.c
@@ -2241,8 +2241,8 @@ static void test_namespaceuri(void)
 
 static void test_read_charref(void)
 {
-    static const char testA[] = "<a b=\"c\">&#x1f3;&#x103;</a>";
-    static const WCHAR chardataW[] = {0x01f3,0x0103,0};
+    static const char testA[] = "<a b=\"c\">&#x1f3;&#x103;></a>";
+    static const WCHAR chardataW[] = {0x01f3,0x0103,'>',0};
     const WCHAR *value;
     IXmlReader *reader;
     XmlNodeType type;
@@ -2252,7 +2252,7 @@ static void test_read_charref(void)
     hr = CreateXmlReader(&IID_IXmlReader, (void **)&reader, NULL);
     ok(hr == S_OK, "S_OK, got %08x\n", hr);
 
-    stream = create_stream_on_data(testA, sizeof(testA));
+    stream = create_stream_on_data(testA, sizeof(testA)-1);
     hr = IXmlReader_SetInput(reader, (IUnknown *)stream);
     ok(hr == S_OK, "got %08x\n", hr);
 
@@ -2272,6 +2272,10 @@ static void test_read_charref(void)
     ok(hr == S_OK, "got %08x\n", hr);
     ok(type == XmlNodeType_EndElement, "Unexpected node type %d\n", type);
 
+    hr = IXmlReader_Read(reader, &type);
+    ok(hr == S_FALSE, "got %08x\n", hr);
+    ok(type == XmlNodeType_None, "Unexpected node type %d\n", type);
+
     IXmlReader_Release(reader);
     IStream_Release(stream);
 }