Fixed a couple of buffer overflows.

This commit is contained in:
Alexandre Julliard 2003-07-09 22:15:33 +00:00
parent da94dd4a1f
commit ea6863c182
2 changed files with 5 additions and 5 deletions

View File

@ -467,7 +467,7 @@ HINTERNET WINAPI HTTP_HttpOpenRequestA(HINTERNET hHttpSession,
lpwhr->lpszHostName = HTTP_strdup(UrlComponents.lpszHostName);
} else if (NULL != hIC->lpszProxy && hIC->lpszProxy[0] != 0) {
char buf[MAXHOSTNAME];
char proxy[MAXHOSTNAME + 13]; /* 13 == "http://" + sizeof(port#) + ":/\0" */
char proxy[MAXHOSTNAME + 15]; /* 15 == "http://" + sizeof(port#) + ":/\0" */
URL_COMPONENTSA UrlComponents;
UrlComponents.lpszExtraInfo = NULL;
@ -481,8 +481,8 @@ HINTERNET WINAPI HTTP_HttpOpenRequestA(HINTERNET hHttpSession,
sprintf(proxy, "http://%s/", hIC->lpszProxy);
InternetCrackUrlA(proxy, 0, 0, &UrlComponents);
if (strlen(UrlComponents.lpszHostName)) {
/* for constant 13 see above */
char* url = HeapAlloc(GetProcessHeap(), 0, strlen(lpwhs->lpszServerName) + strlen(lpwhr->lpszPath) + 13);
/* for constant 15 see above */
char* url = HeapAlloc(GetProcessHeap(), 0, strlen(lpwhs->lpszServerName) + strlen(lpwhr->lpszPath) + 15);
if(UrlComponents.nPort == INTERNET_INVALID_PORT_NUMBER)
UrlComponents.nPort = INTERNET_DEFAULT_HTTP_PORT;

View File

@ -1599,7 +1599,7 @@ BOOL WINAPI InternetSetOptionA(HINTERNET hInternet, DWORD dwOption,
proxlen = MultiByteToWideChar( CP_ACP, 0, pi->lpszProxy, -1, NULL, 0);
prbylen= MultiByteToWideChar( CP_ACP, 0, pi->lpszProxyBypass, -1, NULL, 0);
wlen = sizeof(*piw) + proxlen + prbylen;
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen );
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen*sizeof(WCHAR) );
piw = (LPINTERNET_PROXY_INFOW) wbuffer;
piw->dwAccessType = pi->dwAccessType;
prox = (LPWSTR) &piw[1];
@ -1615,7 +1615,7 @@ BOOL WINAPI InternetSetOptionA(HINTERNET hInternet, DWORD dwOption,
case INTERNET_OPTION_PASSWORD:
wlen = MultiByteToWideChar( CP_ACP, 0, lpBuffer, dwBufferLength,
NULL, 0 );
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen );
wbuffer = HeapAlloc( GetProcessHeap(), 0, wlen*sizeof(WCHAR) );
MultiByteToWideChar( CP_ACP, 0, lpBuffer, dwBufferLength,
wbuffer, wlen );
break;