Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-07-04 11:44:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

wininet: Fixed memory corruption in urlcache.

Browse source 
Author: Marcus Meissner <marcus at jet.franken.de>
Date:   Sun Apr  5 13:55:21 2009 +0200

svn path=/trunk/; revision=40398
This commit is contained in:
Christoph von Wittich 2009-04-06 15:42:28 +00:00
parent 975df12f3c
commit 9854f20f1c
1 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
reactos/dll/win32/wininet/urlcache.c
View file

@ -980,11 +980,13 @@ static BOOL URLCache_CopyEntry(
/* FIXME: is source url optional? */ /* FIXME: is source url optional? */
if (*lpdwBufferSize >= dwRequiredSize) if (*lpdwBufferSize >= dwRequiredSize)
{ {
lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrl - 1; DWORD lenUrlBytes = (lenUrl+1) * (bUnicode ? sizeof(WCHAR) : sizeof(CHAR));
if (bUnicode)
MultiByteToWideChar(CP_ACP, 0, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, -1, (LPWSTR)lpCacheEntryInfo->lpszSourceUrlName, lenUrl + 1); lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrlBytes;
else if (bUnicode)
memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, (lenUrl + 1) * sizeof(CHAR)); MultiByteToWideChar(CP_ACP, 0, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, -1, (LPWSTR)lpCacheEntryInfo->lpszSourceUrlName, lenUrl + 1);
else
memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, lenUrlBytes);
} }
if ((dwRequiredSize % 4) && (dwRequiredSize < *lpdwBufferSize)) if ((dwRequiredSize % 4) && (dwRequiredSize < *lpdwBufferSize))