From 6766fb687ff3fcb344496ad7e81c9bb5f8933117 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bernhard=20=C3=9Cbelacker?= Date: Tue, 6 Jul 2021 14:23:13 +0200 Subject: [PATCH] hhctrl.ocx: Handle only the number of bytes given in html_fragment_len. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=39699 Signed-off-by: Bernhard Übelacker Signed-off-by: Alexandre Julliard (cherry picked from commit e3b28631485a010219928a888fcc543a5bb3c61d) Signed-off-by: Michael Stefaniuc --- dlls/hhctrl.ocx/help.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/hhctrl.ocx/help.c b/dlls/hhctrl.ocx/help.c index 06f73358f44..e9957a86e73 100644 --- a/dlls/hhctrl.ocx/help.c +++ b/dlls/hhctrl.ocx/help.c @@ -1898,14 +1898,14 @@ WCHAR *decode_html(const char *html_fragment, int html_fragment_len, UINT code_p while(1) { symbol = 0; - amp = strchr(h, '&'); + amp = memchr(h, '&', html_fragment + html_fragment_len - h); if(!amp) break; len = amp-h; /* Copy the characters prior to the HTML encoded character */ memcpy(&tmp[tmp_len], h, len); tmp_len += len; amp++; /* skip ampersand */ - sem = strchr(amp, ';'); + sem = memchr(amp, ';', html_fragment + html_fragment_len - amp); /* Require a semicolon after the ampersand */ if(!sem) {