From: Jiajin Cui <cuijiajin@uniontech.com> Pass the ANSI buffer length in characters and account for the null terminator before copying the cache path. Signed-off-by: Jiajin Cui <cuijiajin@uniontech.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --- dlls/urlmon/umon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/urlmon/umon.c b/dlls/urlmon/umon.c index 0ee8502d070..f00895f9384 100644 --- a/dlls/urlmon/umon.c +++ b/dlls/urlmon/umon.c @@ -850,7 +850,7 @@ HRESULT WINAPI URLDownloadToCacheFileA(LPUNKNOWN lpUnkCaller, LPCSTR szURL, LPST if(szFileName) file_name = malloc(dwBufLength * sizeof(WCHAR)); - hres = URLDownloadToCacheFileW(lpUnkCaller, url, file_name, dwBufLength*sizeof(WCHAR), + hres = URLDownloadToCacheFileW(lpUnkCaller, url, file_name, dwBufLength, dwReserved, pBSC); if(SUCCEEDED(hres) && file_name) @@ -899,7 +899,7 @@ HRESULT WINAPI URLDownloadToCacheFileW(LPUNKNOWN lpUnkCaller, LPCWSTR szURL, LPW header, sizeof(header), NULL, NULL)) return E_FAIL; - if (lstrlenW(cache_path) > dwBufLength) + if (lstrlenW(cache_path) + 1 > dwBufLength) return E_OUTOFMEMORY; lstrcpyW(szFileName, cache_path); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/11255