From d7357a49561e0e51063d5c14c6776201b0f00421 Mon Sep 17 00:00:00 2001
From: Alexandre Julliard <julliard@winehq.org>
Date: Thu, 22 Jul 2004 20:36:36 +0000
Subject: [PATCH] Fixed a couple of off-by-one errors.

---
 dlls/wininet/http.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c
index 3837ace4705..9862c6b1292 100644
--- a/dlls/wininet/http.c
+++ b/dlls/wininet/http.c
@@ -1551,8 +1551,8 @@ BOOL WINAPI HTTP_HttpSendRequestW(LPWININETHTTPREQW lpwhr, LPCWSTR lpszHeaders,
         }
 
         /* allocate space for an array of all the string pointers to be added */
-        len = (HTTP_QUERY_MAX + lpwhr->nCustHeaders)*4 + 8;
-        req = HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, len*sizeof(LPCWSTR) );
+        len = (HTTP_QUERY_MAX + lpwhr->nCustHeaders)*4 + 9;
+        req = HeapAlloc( GetProcessHeap(), 0, len*sizeof(LPCWSTR) );
 
         /* add the verb, path and HTTP/1.0 */
         n = 0;
@@ -1604,7 +1604,7 @@ BOOL WINAPI HTTP_HttpSendRequestW(LPWININETHTTPREQW lpwhr, LPCWSTR lpszHeaders,
             req[n++] = lpwhr->lpszHostName;
         }
 
-        if( n > len )
+        if( n >= len )
             ERR("oops. buffer overrun\n");
 
         req[n] = NULL;