Thomas Faber : msxml3: Avoid buffer overflow in BindStatusCallback_GetBindInfo (DPH).

[Alexandre Julliard]

Module: wine
Branch: master
Commit: a64403904dfc50ed81c1a724f9a322e5ae4a025b
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=a64403904dfc50ed81c1a724f...

Author: Thomas Faber <thomas.faber(a)reactos.org>
Date:   Mon Apr 23 12:08:58 2018 +0200

msxml3: Avoid buffer overflow in BindStatusCallback_GetBindInfo (DPH).

Signed-off-by: Thomas Faber <thomas.faber(a)reactos.org>
Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/msxml3/httprequest.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/msxml3/httprequest.c b/dlls/msxml3/httprequest.c
index 40a9764..07eeb74 100644
--- a/dlls/msxml3/httprequest.c
+++ b/dlls/msxml3/httprequest.c
@@ -397,7 +397,7 @@ static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
     pbindinfo->dwBindVerb = This->request->verb;
     if (This->request->verb == BINDVERB_CUSTOM)
     {
-        pbindinfo->szCustomVerb = CoTaskMemAlloc(SysStringByteLen(This->request->custom));
+        pbindinfo->szCustomVerb = CoTaskMemAlloc(SysStringByteLen(This->request->custom)+sizeof(WCHAR));
         strcpyW(pbindinfo->szCustomVerb, This->request->custom);
     }