Author: cwittich Date: Mon Apr 6 19:42:28 2009 New Revision: 40398 URL: http://svn.reactos.org/svn/reactos?rev=40398&view=rev Log: wininet: Fixed memory corruption in urlcache. Author: Marcus Meissner <marcus at jet.franken.de> Date: Sun Apr 5 13:55:21 2009 +0200
Modified: trunk/reactos/dll/win32/wininet/urlcache.c Modified: trunk/reactos/dll/win32/wininet/urlcache.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/wininet/urlcache.c?rev=40398&r1=40397&r2=40398&view=diff ============================================================================== --- trunk/reactos/dll/win32/wininet/urlcache.c [iso-8859-1] (original) +++ trunk/reactos/dll/win32/wininet/urlcache.c [iso-8859-1] Mon Apr 6 19:42:28 2009 @@ -980,11 +980,13 @@ /* FIXME: is source url optional? */ if (*lpdwBufferSize >= dwRequiredSize) { - lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrl - 1; - if (bUnicode) - MultiByteToWideChar(CP_ACP, 0, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, -1, (LPWSTR)lpCacheEntryInfo->lpszSourceUrlName, lenUrl + 1); - else - memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, (lenUrl + 1) * sizeof(CHAR)); + DWORD lenUrlBytes = (lenUrl+1) * (bUnicode ? sizeof(WCHAR) : sizeof(CHAR)); + + lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrlBytes; + if (bUnicode) + MultiByteToWideChar(CP_ACP, 0, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, -1, (LPWSTR)lpCacheEntryInfo->lpszSourceUrlName, lenUrl + 1); + else + memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, lenUrlBytes); } if ((dwRequiredSize % 4) && (dwRequiredSize < *lpdwBufferSize))