Re: [PATCH] mshtml: fixed second buffer argument to MultiByteToWideChar

[Austin English]

On Wed, Feb 4, 2009 at 2:11 PM, Marcus Meissner <marcus(a)jet.franken.de> wrote:
> Hi,
>
> Targetbuffer length must not be -1.
>
> Ciao, Marcus
> ---
>  dlls/mshtml/editor.c   |    2 +-
>  dlls/mshtml/navigate.c |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/dlls/mshtml/editor.c b/dlls/mshtml/editor.c
> index 7cbdf2e..e92cf96 100644
> --- a/dlls/mshtml/editor.c
> +++ b/dlls/mshtml/editor.c
> @@ -588,7 +588,7 @@ static HRESULT exec_fontname(HTMLDocument *This, DWORD cmdexecopt, VARIANT *in,
>
> len = MultiByteToWideChar(CP_ACP, 0, stra, -1, NULL, 0);
>         strw = heap_alloc(len*sizeof(WCHAR));
> -        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, -1);
> +        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, len);
>         nsfree(stra);
>
> V_BSTR(out) = SysAllocString(strw);
> diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c
> index 188cdd7..6e41699 100644
> --- a/dlls/mshtml/navigate.c
> +++ b/dlls/mshtml/navigate.c
> @@ -657,7 +657,7 @@ static void parse_post_data(nsIInputStream *post_data_stream, LPWSTR *headers_re
>         else
>             headers = heap_alloc((len+1)*sizeof(WCHAR));
>
> -        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, -1);
> +        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, len);
>         headers_len += len;
>
> ptr2 = ptr;
> --
> 1.5.6

Are these coverity fixes?

-- 
-Austin

[PATCH] mshtml: fixed second buffer argument to MultiByteToWideChar

[Marcus Meissner]

On Wed, Feb 04, 2009 at 02:15:04PM -0600, Austin English wrote:
> On Wed, Feb 4, 2009 at 2:11 PM, Marcus Meissner <marcus(a)jet.franken.de> wrote:
> > Hi,
> >
> > Targetbuffer length must not be -1.
> >
> > Ciao, Marcus
> > ---
> >  dlls/mshtml/editor.c   |    2 +-
> >  dlls/mshtml/navigate.c |    2 +-
> >  2 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/dlls/mshtml/editor.c b/dlls/mshtml/editor.c
> > index 7cbdf2e..e92cf96 100644
> > --- a/dlls/mshtml/editor.c
> > +++ b/dlls/mshtml/editor.c
> > @@ -588,7 +588,7 @@ static HRESULT exec_fontname(HTMLDocument *This, DWORD cmdexecopt, VARIANT *in,
> >
> > len = MultiByteToWideChar(CP_ACP, 0, stra, -1, NULL, 0);
> >         strw = heap_alloc(len*sizeof(WCHAR));
> > -        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, -1);
> > +        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, len);
> >         nsfree(stra);
> >
> > V_BSTR(out) = SysAllocString(strw);
> > diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c
> > index 188cdd7..6e41699 100644
> > --- a/dlls/mshtml/navigate.c
> > +++ b/dlls/mshtml/navigate.c
> > @@ -657,7 +657,7 @@ static void parse_post_data(nsIInputStream *post_data_stream, LPWSTR *headers_re
> >         else
> >             headers = heap_alloc((len+1)*sizeof(WCHAR));
> >
> > -        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, -1);
> > +        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, len);
> >         headers_len += len;
> >
> > ptr2 = ptr;
> > --
> > 1.5.6
>
> Are these coverity fixes?

No, I spotted this problem while debugging something, and just looked
through the sourcecode for all occurences. I think I got all of them now.

CIao, Marcus