hhctrl.ocx: Handle only the number of bytes given in html_fragment_len.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=39699
Signed-off-by: Bernhard Übelacker <bernhardu@mailbox.org>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
(cherry picked from commit e3b2863148)
Signed-off-by: Michael Stefaniuc <mstefani@winehq.org>
This commit is contained in:
Bernhard Übelacker 2021-07-06 14:23:13 +02:00 committed by Michael Stefaniuc
parent 2e51da6f16
commit 6766fb687f
1 changed files with 2 additions and 2 deletions

View File

@ -1898,14 +1898,14 @@ WCHAR *decode_html(const char *html_fragment, int html_fragment_len, UINT code_p
while(1)
{
symbol = 0;
amp = strchr(h, '&');
amp = memchr(h, '&', html_fragment + html_fragment_len - h);
if(!amp) break;
len = amp-h;
/* Copy the characters prior to the HTML encoded character */
memcpy(&tmp[tmp_len], h, len);
tmp_len += len;
amp++; /* skip ampersand */
sem = strchr(amp, ';');
sem = memchr(amp, ';', html_fragment + html_fragment_len - amp);
/* Require a semicolon after the ampersand */
if(!sem)
{