Re: resend: http.c: redirect corrections.

[Robert Shearman]

Aric Stewart wrote:
> Index: dlls/wininet/http.c
> ===================================================================
> RCS file: /home/wine/wine/dlls/wininet/http.c,v
> retrieving revision 1.113
> diff -u -r1.113 http.c
> --- dlls/wininet/http.c	22 Nov 2005 14:53:30 -0000	1.113
> +++ dlls/wininet/http.c	22 Nov 2005 15:35:24 -0000
> @@ -629,6 +634,26 @@
>
> /* We appear to do nothing with the buffer.. is that correct? */
>
> +    if(!(lpwhr->hdr.dwFlags & INTERNET_FLAG_NO_AUTO_REDIRECT))
> +    {
> +        DWORD dwCode,dwCodeLength=sizeof(DWORD),dwIndex=0;
> +        if(HTTP_HttpQueryInfoW(lpwhr,HTTP_QUERY_FLAG_NUMBER|HTTP_QUERY_STATUS_CODE,&dwCode,&dwCodeLength,&dwIndex) &&
> +            (dwCode==302 || dwCode==301))
> +        {
> +            WCHAR szNewLocation[2048];
> +            DWORD dwBufferSize=2048;
> +            dwIndex=0;
> +            if(HTTP_HttpQueryInfoW(lpwhr,HTTP_QUERY_LOCATION,szNewLocation,&dwBufferSize,&dwIndex))
> +            {
> +	            static const WCHAR szGET[] = { 'G','E','T', 0 };
> +                /* redirects are always GETs */
> +                HeapFree(GetProcessHeap(),0,lpwhr->lpszVerb);
> +	            lpwhr->lpszVerb = WININET_strdupW(szGET);
> +                return HTTP_HandleRedirect(lpwhr, szNewLocation, NULL, 0, NULL, 0);
> +            }
> +        }
> +    }
> +
>     TRACE("%i <--\n",rc);
>     return rc;
> }

This proves that HttpSendRequestEx and HttpSendRequest need to share 
more code.
> @@ -1849,13 +1885,26 @@
> #endif
>
> HeapFree(GetProcessHeap(), 0, lpwhs->lpszServerName);
> -        lpwhs->lpszServerName = WININET_strdupW(hostName);
> +        if (urlComponents.nPort != INTERNET_DEFAULT_HTTP_PORT &&
> +                urlComponents.nPort != INTERNET_DEFAULT_HTTPS_PORT)
> +        {
> +            int len;
> +            static WCHAR fmt[] = {'%','s',':','%','i',0};
> +            len = lstrlenW(hostName);
> +            len+=6;
> +            lpwhs->lpszServerName = HeapAlloc(GetProcessHeap(),0,len*sizeof(WCHAR));

I submitted a patch to unbreak the Host header for proxies that means 
you should be changing lpwhs->lpszHostName now.
> +            sprintfW(lpwhs->lpszServerName,fmt,hostName,urlComponents.nPort);
> +        }
> +        else
> +            lpwhs->lpszServerName = WININET_strdupW(hostName);
> +
> +        HTTP_ProcessHeader(lpwhr, g_szHost, lpwhs->lpszServerName, HTTP_ADDREQ_FLAG_ADD | HTTP_ADDREQ_FLAG_REPLACE | HTTP_ADDHDR_FLAG_REQ);
> +
> +

And you should be sending lpwhs->lpszHostName.
> @@ -1868,6 +1917,9 @@
>             return FALSE;
>         }
>
> +        if (lstrlenW(extra)>0)
> +            StrCatW(path,extra);

Why are you using a shlwapi string function? What's wrong with strcatW 
or lstrcatW?

Also, this could easily cause a buffer overflow by a server sending a 
redirect with a large query. You need to check that there is enough 
space before blinding copying into the buffer.

- 
Rob Shearman