Alexandre Julliard pushed to branch master at wine / wine Commits: e97335a7 by Yuxuan Shui at 2026-04-20T20:39:17+02:00 urlmon/tests: Test output length calculation when output buffer is too small. Native handles this poorly. When the buffer isn't large enough for URI unescaping, native will return STATUS_SUCCESS with a 0 output length. Besides that, on <= Windows 10 v1507, there are additional cases where the returned length is 0. This appears to have been fixed in later versions. Unsure if we need bug compatibility here. - - - - - 8840f1da by Yuxuan Shui at 2026-04-20T20:39:17+02:00 iertutil: Fix out-of-bound access in remove_dot_segments. parse_canonicalize will stop writing into the output buffer when the amount to write exceeded output_len, but it will still call remove_dot_segments and give it a path length that goes past the end of the output buffer, causing it to read out of bound. Additionally, we can't simply reject the input once we exceeded the capacity of the output buffer because dot segments removal might bring the length down within the limit. The current implementation is incorrect in this case since the output has already been cut off. This commit creates a temporary buffer and does dot segments removal first, and then everything else. There is further evidence that this is how native does it too, because if a path segment is "%2E." (%2E is "." when decoded), native will not remove it, which it would have done if dot segments removal happens after unescaping. This is included as an additional uri_parse_test. - - - - - 2 changed files: - dlls/iertutil/uri.c - dlls/urlmon/tests/uri.c View it on GitLab: https://gitlab.winehq.org/wine/wine/-/compare/edd421c9e62e0f76ce0aefc8cda484... -- View it on GitLab: https://gitlab.winehq.org/wine/wine/-/compare/edd421c9e62e0f76ce0aefc8cda484... You're receiving this email because of your account on gitlab.winehq.org. Manage all notifications: https://gitlab.winehq.org/-/profile/notifications | Help: https://gitlab.winehq.org/help