From 5caf80942657bc1b067acfc3f9decc6970ef2fcb Mon Sep 17 00:00:00 2001 From: Eric van Beurden Date: Thu, 4 Jun 2009 10:52:16 -0400 Subject: [PATCH] wininet: Check for bad allocation in HeapReAlloc. --- dlls/wininet/http.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c index b11ce21c416..c6873ae86ea 100644 --- a/dlls/wininet/http.c +++ b/dlls/wininet/http.c @@ -4160,6 +4160,7 @@ static INT HTTP_GetResponseHeaders(LPWININETHTTPREQW lpwhr, BOOL clear) LPWSTR status_code, status_text; DWORD cchMaxRawHeaders = 1024; LPWSTR lpszRawHeaders = HeapAlloc(GetProcessHeap(), 0, (cchMaxRawHeaders+1)*sizeof(WCHAR)); + LPWSTR temp; DWORD cchRawHeaders = 0; TRACE("-->\n"); @@ -4213,10 +4214,10 @@ static INT HTTP_GetResponseHeaders(LPWININETHTTPREQW lpwhr, BOOL clear) /* regenerate raw headers */ while (cchRawHeaders + buflen + strlenW(szCrLf) > cchMaxRawHeaders) - { cchMaxRawHeaders *= 2; - lpszRawHeaders = HeapReAlloc(GetProcessHeap(), 0, lpszRawHeaders, (cchMaxRawHeaders+1)*sizeof(WCHAR)); - } + temp = HeapReAlloc(GetProcessHeap(), 0, lpszRawHeaders, (cchMaxRawHeaders+1)*sizeof(WCHAR)); + if (temp == NULL) goto lend; + lpszRawHeaders = temp; memcpy(lpszRawHeaders+cchRawHeaders, buffer, (buflen-1)*sizeof(WCHAR)); cchRawHeaders += (buflen-1); memcpy(lpszRawHeaders+cchRawHeaders, szCrLf, sizeof(szCrLf)); @@ -4242,10 +4243,10 @@ static INT HTTP_GetResponseHeaders(LPWININETHTTPREQW lpwhr, BOOL clear) MultiByteToWideChar( CP_ACP, 0, bufferA, buflen, buffer, MAX_REPLY_LEN ); while (cchRawHeaders + buflen + strlenW(szCrLf) > cchMaxRawHeaders) - { cchMaxRawHeaders *= 2; - lpszRawHeaders = HeapReAlloc(GetProcessHeap(), 0, lpszRawHeaders, (cchMaxRawHeaders+1)*sizeof(WCHAR)); - } + temp = HeapReAlloc(GetProcessHeap(), 0, lpszRawHeaders, (cchMaxRawHeaders+1)*sizeof(WCHAR)); + if (temp == NULL) goto lend; + lpszRawHeaders = temp; memcpy(lpszRawHeaders+cchRawHeaders, buffer, (buflen-1)*sizeof(WCHAR)); cchRawHeaders += (buflen-1); memcpy(lpszRawHeaders+cchRawHeaders, szCrLf, sizeof(szCrLf));