[PATCH 2/4] winhttp: Copy the reason buffer.

[Hans Leidekker]

Signed-off-by: Hans Leidekker <hans at codeweavers.com>
---
 dlls/winhttp/request.c         | 8 ++++----
 dlls/winhttp/tests/winhttp.c   | 6 ++++++
 dlls/winhttp/winhttp_private.h | 4 ++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/dlls/winhttp/request.c b/dlls/winhttp/request.c
index bc3d365f7c..06588d6f60 100644
--- a/dlls/winhttp/request.c
+++ b/dlls/winhttp/request.c
@@ -3463,7 +3463,7 @@ DWORD WINAPI WinHttpWebSocketShutdown( HINTERNET hsocket, USHORT status, void *r
 
     TRACE("%p, %u, %p, %u\n", hsocket, status, reason, len);
 
-    if (len && !reason) return ERROR_INVALID_PARAMETER;
+    if ((len && !reason) || len > sizeof(socket->reason)) return ERROR_INVALID_PARAMETER;
 
     if (!(socket = (struct socket *)grab_object( hsocket ))) return ERROR_INVALID_HANDLE;
     if (socket->hdr.type != WINHTTP_HANDLE_TYPE_SOCKET)
@@ -3484,7 +3484,7 @@ DWORD WINAPI WinHttpWebSocketShutdown( HINTERNET hsocket, USHORT status, void *r
         if (!(s = heap_alloc( sizeof(*s) ))) return FALSE;
         s->socket = socket;
         s->status = status;
-        s->reason = reason;
+        memcpy( s->reason, reason, len );
         s->len    = len;
 
         addref_object( &socket->hdr );
@@ -3569,7 +3569,7 @@ DWORD WINAPI WinHttpWebSocketClose( HINTERNET hsocket, USHORT status, void *reas
 
     TRACE("%p, %u, %p, %u\n", hsocket, status, reason, len);
 
-    if (len && !reason) return ERROR_INVALID_PARAMETER;
+    if ((len && !reason) || len > sizeof(socket->reason)) return ERROR_INVALID_PARAMETER;
 
     if (!(socket = (struct socket *)grab_object( hsocket ))) return ERROR_INVALID_HANDLE;
     if (socket->hdr.type != WINHTTP_HANDLE_TYPE_SOCKET)
@@ -3590,7 +3590,7 @@ DWORD WINAPI WinHttpWebSocketClose( HINTERNET hsocket, USHORT status, void *reas
         if (!(s = heap_alloc( sizeof(*s) ))) return FALSE;
         s->socket = socket;
         s->status = status;
-        s->reason = reason;
+        memcpy( s->reason, reason, len );
         s->len    = len;
 
         addref_object( &socket->hdr );
diff --git a/dlls/winhttp/tests/winhttp.c b/dlls/winhttp/tests/winhttp.c
index 12f5136973..84063fdc82 100644
--- a/dlls/winhttp/tests/winhttp.c
+++ b/dlls/winhttp/tests/winhttp.c
@@ -3356,6 +3356,9 @@ static void test_websocket(int port)
     error = pWinHttpWebSocketShutdown(socket, WINHTTP_WEB_SOCKET_SUCCESS_CLOSE_STATUS, NULL, 1);
     ok(error == ERROR_INVALID_PARAMETER, "got %u\n", error);
 
+    error = pWinHttpWebSocketShutdown(socket, WINHTTP_WEB_SOCKET_SUCCESS_CLOSE_STATUS, buf, sizeof(buf));
+    ok(error == ERROR_INVALID_PARAMETER, "got %u\n", error);
+
     error = pWinHttpWebSocketShutdown(socket, WINHTTP_WEB_SOCKET_SUCCESS_CLOSE_STATUS, (void *)"success",
                                       sizeof("success"));
     ok(!error, "got %u\n", error);
@@ -3363,6 +3366,9 @@ static void test_websocket(int port)
     error = pWinHttpWebSocketClose(socket, WINHTTP_WEB_SOCKET_SUCCESS_CLOSE_STATUS, NULL, 1);
     ok(error == ERROR_INVALID_PARAMETER, "got %u\n", error);
 
+    error = pWinHttpWebSocketClose(socket, WINHTTP_WEB_SOCKET_SUCCESS_CLOSE_STATUS, buf, sizeof(buf));
+    ok(error == ERROR_INVALID_PARAMETER, "got %u\n", error);
+
     error = pWinHttpWebSocketClose(socket, WINHTTP_WEB_SOCKET_SUCCESS_CLOSE_STATUS, (void *)"success2",
                                    sizeof("success2"));
     ok(!error, "got %u\n", error);
diff --git a/dlls/winhttp/winhttp_private.h b/dlls/winhttp/winhttp_private.h
index ac7e9ff09b..9d0b9c308a 100644
--- a/dlls/winhttp/winhttp_private.h
+++ b/dlls/winhttp/winhttp_private.h
@@ -244,7 +244,7 @@ struct socket
     enum socket_opcode opcode;
     DWORD read_size;
     USHORT status;
-    char reason[128];
+    char reason[123];
     DWORD reason_len;
 };
 
@@ -305,7 +305,7 @@ struct socket_shutdown
 {
     struct socket *socket;
     USHORT status;
-    const void *reason;
+    char reason[123];
     DWORD len;
 };
 
-- 
2.20.1