From cb80692cf86ef133a75d47b569568b43caee59a3 Mon Sep 17 00:00:00 2001 From: Marcus Meissner Date: Sun, 5 Apr 2009 13:55:21 +0200 Subject: [PATCH] wininet: Fixed memory corruption in urlcache. --- dlls/wininet/urlcache.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dlls/wininet/urlcache.c b/dlls/wininet/urlcache.c index bf67fecec03..b4feba3260c 100644 --- a/dlls/wininet/urlcache.c +++ b/dlls/wininet/urlcache.c @@ -995,11 +995,13 @@ static DWORD URLCache_CopyEntry( /* FIXME: is source url optional? */ if (*lpdwBufferSize >= dwRequiredSize) { - lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrl - 1; + DWORD lenUrlBytes = (lenUrl+1) * (bUnicode ? sizeof(WCHAR) : sizeof(CHAR)); + + lpCacheEntryInfo->lpszSourceUrlName = (LPSTR)lpCacheEntryInfo + dwRequiredSize - lenUrlBytes; if (bUnicode) MultiByteToWideChar(CP_ACP, 0, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, -1, (LPWSTR)lpCacheEntryInfo->lpszSourceUrlName, lenUrl + 1); else - memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, (lenUrl + 1) * sizeof(CHAR)); + memcpy(lpCacheEntryInfo->lpszSourceUrlName, (LPSTR)pUrlEntry + pUrlEntry->dwOffsetUrl, lenUrlBytes); } if ((dwRequiredSize % 4) && (dwRequiredSize < *lpdwBufferSize)) -- 2.11.4.GIT