ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

wininet: Deal with bogus accept types array passed into HttpOpenRequestA.

This commit is contained in:
Hans Leidekker 2008-05-07 13:19:37 +02:00 committed by Alexandre Julliard
parent 3da466a9f7
commit 493b6915ca
2 changed files with 56 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
dlls/wininet/http.c
View File

@ -964,9 +964,10 @@ HINTERNET WINAPI HttpOpenRequestA(HINTERNET hHttpSession,
{
LPWSTR szVerb = NULL, szObjectName = NULL;
LPWSTR szVersion = NULL, szReferrer = NULL, *szAcceptTypes = NULL;
INT len;
INT acceptTypesCount;
INT len, acceptTypesCount;
HINTERNET rc = FALSE;
LPCSTR *types;
TRACE("(%p, %s, %s, %s, %s, %p, %08x, %08lx)\n", hHttpSession,
debugstr_a(lpszVerb), debugstr_a(lpszObjectName),
debugstr_a(lpszVersion), debugstr_a(lpszReferrer), lpszAcceptTypes,
@ -1008,24 +1009,37 @@ HINTERNET WINAPI HttpOpenRequestA(HINTERNET hHttpSession,
MultiByteToWideChar(CP_ACP, 0, lpszReferrer, -1, szReferrer, len );
}
acceptTypesCount = 0;
if (lpszAcceptTypes)
{
/* find out how many there are */
while (lpszAcceptTypes[acceptTypesCount] && *lpszAcceptTypes[acceptTypesCount])
acceptTypesCount++;
szAcceptTypes = HeapAlloc(GetProcessHeap(), 0, sizeof(WCHAR *) * (acceptTypesCount+1));
acceptTypesCount = 0;
while (lpszAcceptTypes[acceptTypesCount] && *lpszAcceptTypes[acceptTypesCount])
types = lpszAcceptTypes;
while (*types)
{
len = MultiByteToWideChar(CP_ACP, 0, lpszAcceptTypes[acceptTypesCount],
-1, NULL, 0 );
szAcceptTypes[acceptTypesCount] = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
if (!szAcceptTypes[acceptTypesCount] )
goto end;
MultiByteToWideChar(CP_ACP, 0, lpszAcceptTypes[acceptTypesCount],
-1, szAcceptTypes[acceptTypesCount], len );
acceptTypesCount++;
/* find out how many there are */
if (((ULONG_PTR)*types >> 16) && **types)
{
TRACE("accept type: %s\n", debugstr_a(*types));
acceptTypesCount++;
}
types++;
}
szAcceptTypes = HeapAlloc(GetProcessHeap(), 0, sizeof(WCHAR *) * (acceptTypesCount+1));
if (!szAcceptTypes) goto end;
acceptTypesCount = 0;
types = lpszAcceptTypes;
while (*types)
{
if (((ULONG_PTR)*types >> 16) && **types)
{
len = MultiByteToWideChar(CP_ACP, 0, *types, -1, NULL, 0 );
szAcceptTypes[acceptTypesCount] = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
if (!szAcceptTypes[acceptTypesCount]) goto end;
MultiByteToWideChar(CP_ACP, 0, *types, -1, szAcceptTypes[acceptTypesCount], len);
acceptTypesCount++;
}
types++;
}
szAcceptTypes[acceptTypesCount] = NULL;
}

26
dlls/wininet/tests/http.c
View File

@ -1746,6 +1746,31 @@ static void test_user_agent_header(void)
InternetCloseHandle(ses);
}
static void test_bogus_accept_types_array(void)
{
HINTERNET ses, con, req;
static const char *types[] = { (const char *)6240, "*/*", "%p", "", "*/*", NULL };
DWORD size;
char buffer[32];
BOOL ret;
ses = InternetOpen("MERONG(0.9/;p)", INTERNET_OPEN_TYPE_DIRECT, "", "", 0);
con = InternetConnect(ses, "www.winehq.org", 80, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 0);
req = HttpOpenRequest(con, "POST", "/post/post_action.php", "HTTP/1.0", "", types, INTERNET_FLAG_FORMS_SUBMIT, 0);
ok(req != NULL, "HttpOpenRequest failed: %u\n", GetLastError());
buffer[0] = 0;
size = sizeof(buffer);
ret = HttpQueryInfo(req, HTTP_QUERY_ACCEPT | HTTP_QUERY_FLAG_REQUEST_HEADERS, buffer, &size, NULL);
ok(ret, "HttpQueryInfo failed: %u\n", GetLastError());
ok(!strcmp(buffer, "*/*, %p, */*"), "got '%s' expected '*/*, %%p, */*'\n", buffer);
InternetCloseHandle(req);
InternetCloseHandle(con);
InternetCloseHandle(ses);
}
#define STATUS_STRING(status) \
memcpy(status_string[status], #status, sizeof(CHAR) * \
(strlen(#status) < MAX_STATUS_NAME ? \
@ -1821,4 +1846,5 @@ START_TEST(http)
HttpHeaders_test();
test_http_connection();
test_user_agent_header();
test_bogus_accept_types_array();
}