[PATCH 0/1] MR9338: itss: Avoid reading beyond buffer end in ITSProtocol_Start (ASan).

[Bernhard Übelacker]

[ASan report details](https://gitlab.winehq.org/bernhardu/wine/-/blob/asan-pe_2025-10-18_wine-10.1...)

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9338

[PATCH 1/1] itss: Avoid reading beyond buffer end in ITSProtocol_Start (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker <bernhardu(a)mailbox.org>

---
 dlls/itss/protocol.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/itss/protocol.c b/dlls/itss/protocol.c
index cb1df3c2e1a..d1ee38191e4 100644
--- a/dlls/itss/protocol.c
+++ b/dlls/itss/protocol.c
@@ -250,7 +250,7 @@ static HRESULT WINAPI ITSProtocol_Start(IInternetProtocol *iface, LPCWSTR szUrl,
 
     len = lstrlenW(ptr)+3;
     file_name = HeapAlloc(GetProcessHeap(), 0, len*sizeof(WCHAR));
-    memcpy(file_name, ptr, len*sizeof(WCHAR));
+    memcpy(file_name, ptr, (len-2)*sizeof(WCHAR));
     hres = UrlUnescapeW(file_name, NULL, &len, URL_UNESCAPE_INPLACE);
     if(FAILED(hres)) {
         WARN("UrlUnescape failed: %08lx\n", hres);
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/9338