Fixed a couple of buffer overflows.
This commit is contained in:
parent
da94dd4a1f
commit
ea6863c182
|
@ -467,7 +467,7 @@ HINTERNET WINAPI HTTP_HttpOpenRequestA(HINTERNET hHttpSession,
|
|||
lpwhr->lpszHostName = HTTP_strdup(UrlComponents.lpszHostName);
|
||||
} else if (NULL != hIC->lpszProxy && hIC->lpszProxy[0] != 0) {
|
||||
char buf[MAXHOSTNAME];
|
||||
char proxy[MAXHOSTNAME + 13]; /* 13 == "http://" + sizeof(port#) + ":/\0" */
|
||||
char proxy[MAXHOSTNAME + 15]; /* 15 == "http://" + sizeof(port#) + ":/\0" */
|
||||
URL_COMPONENTSA UrlComponents;
|
||||
|
||||
UrlComponents.lpszExtraInfo = NULL;
|
||||
|
@ -481,8 +481,8 @@ HINTERNET WINAPI HTTP_HttpOpenRequestA(HINTERNET hHttpSession,
|
|||
sprintf(proxy, "http://%s/", hIC->lpszProxy);
|
||||
InternetCrackUrlA(proxy, 0, 0, &UrlComponents);
|
||||
if (strlen(UrlComponents.lpszHostName)) {
|
||||
/* for constant 13 see above */
|
||||
char* url = HeapAlloc(GetProcessHeap(), 0, strlen(lpwhs->lpszServerName) + strlen(lpwhr->lpszPath) + 13);
|
||||
/* for constant 15 see above */
|
||||
char* url = HeapAlloc(GetProcessHeap(), 0, strlen(lpwhs->lpszServerName) + strlen(lpwhr->lpszPath) + 15);
|
||||
|
||||
if(UrlComponents.nPort == INTERNET_INVALID_PORT_NUMBER)
|
||||
UrlComponents.nPort = INTERNET_DEFAULT_HTTP_PORT;
|
||||
|
|
|
@ -1599,7 +1599,7 @@ BOOL WINAPI InternetSetOptionA(HINTERNET hInternet, DWORD dwOption,
|
|||
proxlen = MultiByteToWideChar( CP_ACP, 0, pi->lpszProxy, -1, NULL, 0);
|
||||
prbylen= MultiByteToWideChar( CP_ACP, 0, pi->lpszProxyBypass, -1, NULL, 0);
|
||||
wlen = sizeof(*piw) + proxlen + prbylen;
|
||||
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen );
|
||||
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen*sizeof(WCHAR) );
|
||||
piw = (LPINTERNET_PROXY_INFOW) wbuffer;
|
||||
piw->dwAccessType = pi->dwAccessType;
|
||||
prox = (LPWSTR) &piw[1];
|
||||
|
@ -1615,7 +1615,7 @@ BOOL WINAPI InternetSetOptionA(HINTERNET hInternet, DWORD dwOption,
|
|||
case INTERNET_OPTION_PASSWORD:
|
||||
wlen = MultiByteToWideChar( CP_ACP, 0, lpBuffer, dwBufferLength,
|
||||
NULL, 0 );
|
||||
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen );
|
||||
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen*sizeof(WCHAR) );
|
||||
MultiByteToWideChar( CP_ACP, 0, lpBuffer, dwBufferLength,
|
||||
wbuffer, wlen );
|
||||
break;
|
||||
|
|
Loading…
Reference in New Issue