Bernhard Übelacker : hhctrl.ocx: Handle only the number of bytes given in html_fragment_len.

[Alexandre Julliard]

Module: wine
Branch: oldstable
Commit: 6766fb687ff3fcb344496ad7e81c9bb5f8933117
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=6766fb687ff3fcb344496ad7e...

Author: Bernhard Übelacker <bernhardu(a)mailbox.org>
Date:   Tue Jul  6 14:23:13 2021 +0200

hhctrl.ocx: Handle only the number of bytes given in html_fragment_len.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=39699
Signed-off-by: Bernhard Übelacker <bernhardu(a)mailbox.org>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>
(cherry picked from commit e3b28631485a010219928a888fcc543a5bb3c61d)
Signed-off-by: Michael Stefaniuc <mstefani(a)winehq.org>

---

 dlls/hhctrl.ocx/help.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/hhctrl.ocx/help.c b/dlls/hhctrl.ocx/help.c
index 06f73358f44..e9957a86e73 100644
--- a/dlls/hhctrl.ocx/help.c
+++ b/dlls/hhctrl.ocx/help.c
@@ -1898,14 +1898,14 @@ WCHAR *decode_html(const char *html_fragment, int html_fragment_len, UINT code_p
     while(1)
     {
         symbol = 0;
-        amp = strchr(h, '&');
+        amp = memchr(h, '&', html_fragment + html_fragment_len - h);
         if(!amp) break;
         len = amp-h;
         /* Copy the characters prior to the HTML encoded character */
         memcpy(&tmp[tmp_len], h, len);
         tmp_len += len;
         amp++; /* skip ampersand */
-        sem = strchr(amp, ';');
+        sem = memchr(amp, ';', html_fragment + html_fragment_len - amp);
         /* Require a semicolon after the ampersand */
         if(!sem)
         {