From 1f98ede4f01147f3efcf0b41e45b95d857512cd3 Mon Sep 17 00:00:00 2001
From: Aric Stewart <aric@codeweavers.com>
Date: Fri, 14 Dec 2007 16:55:19 +0900
Subject: [PATCH] cryptnet: InternetCrackUrlW requires component buffers when
 used with ICU_DECODE.

---
 dlls/cryptnet/cryptnet_main.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/dlls/cryptnet/cryptnet_main.c b/dlls/cryptnet/cryptnet_main.c
index 0ad302dd743..eba8648b644 100644
--- a/dlls/cryptnet/cryptnet_main.c
+++ b/dlls/cryptnet/cryptnet_main.c
@@ -476,18 +476,16 @@ static BOOL CRYPT_CrackUrl(LPCWSTR pszURL, URL_COMPONENTSW *components)
 
     memset(components, 0, sizeof(*components));
     components->dwStructSize = sizeof(*components);
-    components->dwHostNameLength = 1;
-    components->dwUrlPathLength = 1;
+    components->lpszHostName = CryptMemAlloc(MAX_PATH * sizeof(WCHAR));
+    components->dwHostNameLength = MAX_PATH;
+    components->lpszUrlPath = CryptMemAlloc(MAX_PATH * 2 * sizeof(WCHAR));
+    components->dwUrlPathLength = 2 * MAX_PATH;
     ret = InternetCrackUrlW(pszURL, 0, ICU_DECODE, components);
     if (ret)
     {
-        LPWSTR hostname = strndupW(components->lpszHostName,
-         components->dwHostNameLength);
-        LPWSTR path = strndupW(components->lpszUrlPath,
-         components->dwUrlPathLength);
-
-        components->lpszHostName = hostname;
-        components->lpszUrlPath = path;
+        if ((components->dwUrlPathLength == 2 * MAX_PATH - 1) ||
+            (components->dwHostNameLength == MAX_PATH - 1))
+            FIXME("Buffers are too small\n");
         switch (components->nScheme)
         {
         case INTERNET_SCHEME_FTP:
@@ -873,12 +871,16 @@ static BOOL WINAPI File_RetrieveEncodedObjectW(LPCWSTR pszURL,
     *ppfnFreeObject = CRYPT_FreeBlob;
     *ppvFreeContext = NULL;
 
-    components.dwUrlPathLength = 1;
+    components.lpszUrlPath = CryptMemAlloc(MAX_PATH * 2 * sizeof(WCHAR));
+    components.dwUrlPathLength = 2 * MAX_PATH;
     ret = InternetCrackUrlW(pszURL, 0, ICU_DECODE, &components);
     if (ret)
     {
         LPWSTR path;
 
+        if (components.dwUrlPathLength == 2 * MAX_PATH - 1)
+            FIXME("Buffers are too small\n");
+
         /* 3 == lstrlenW(L"c:") + 1 */
         path = CryptMemAlloc((components.dwUrlPathLength + 3) * sizeof(WCHAR));
         if (path)
@@ -932,6 +934,7 @@ static BOOL WINAPI File_RetrieveEncodedObjectW(LPCWSTR pszURL,
             CryptMemFree(path);
         }
     }
+    CryptMemFree(components.lpszUrlPath);
     return ret;
 }
 
@@ -952,7 +955,7 @@ static BOOL CRYPT_GetRetrieveFunction(LPCWSTR pszURL,
     *pFunc = NULL;
     *phFunc = 0;
     components.dwSchemeLength = 1;
-    ret = InternetCrackUrlW(pszURL, 0, ICU_DECODE, &components);
+    ret = InternetCrackUrlW(pszURL, 0, 0, &components);
     if (ret)
     {
         /* Microsoft always uses CryptInitOIDFunctionSet/