[PATCH 2/4] urlmon/tests: cover URLDownloadToCacheFile buffer bounds

[Jiajin Cui]

From: Jiajin Cui <[e-mail]>

Add coverage for URLDownloadToCacheFileW and URLDownloadToCacheFileA with
long URL extensions to verify output buffers are not overrun.

Signed-off-by: Jiajin Cui <[e-mail]>
---
 dlls/urlmon/tests/misc.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/dlls/urlmon/tests/misc.c b/dlls/urlmon/tests/misc.c
index 2a61b892930..8cfe7fec6ee 100644
--- a/dlls/urlmon/tests/misc.c
+++ b/dlls/urlmon/tests/misc.c
@@ -28,6 +28,7 @@
 #include "winbase.h"
 #include "ole2.h"
 #include "urlmon.h"
+#include "wininet.h"
 
 #include "initguid.h"
 
@@ -2725,6 +2726,38 @@ static void test_bsc_marshaling(void)
     TerminateThread(thread, 0);
 }
 
+static void test_URLDownloadToCacheFile(void)
+{
+    WCHAR url[512], filename[MAX_PATH];
+    static const WCHAR prefix[] = L"http://127.0.0.1:1/test.";
+    char urlA[ARRAY_SIZE(url)], filenameA[MAX_PATH];
+    DWORD size;
+    HRESULT hres;
+    BOOL ret;
+    unsigned int i, len;
+
+    lstrcpyW(url, prefix);
+    len = lstrlenW(url);
+    for(i = len; i < ARRAY_SIZE(url) - 1; i++)
+        url[i] = 'a';
+    url[i] = 0;
+
+    memset(filename, 0xcc, sizeof(filename));
+    hres = URLDownloadToCacheFileW(NULL, url, filename, ARRAY_SIZE(filename), 0, NULL);
+    ok(FAILED(hres), "URLDownloadToCacheFileW returned %#lx\n", hres);
+    ok(filename[ARRAY_SIZE(filename) - 1] == 0xcccc, "filename buffer overflowed\n");
+
+    WideCharToMultiByte(CP_ACP, 0, url, -1, urlA, sizeof(urlA), NULL, NULL);
+    size = 0;
+    ret = GetUrlCacheEntryInfoA(urlA, NULL, &size);
+    ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND, "cache entry was not deleted, error %ld\n", GetLastError());
+
+    memset(filenameA, 0xcc, sizeof(filenameA));
+    hres = URLDownloadToCacheFileA(NULL, urlA, filenameA, sizeof(filenameA), 0, NULL);
+    ok(FAILED(hres), "URLDownloadToCacheFileA returned %#lx\n", hres);
+    ok(filenameA[sizeof(filenameA) - 1] == (char)0xcc, "filenameA buffer overflowed\n");
+}
+
 static void test_MapBrowserEmulationModeToUserAgent(BOOL custom_ua)
 {
     /* Undocumented structure of unknown size, crashes if it's too small (with arbitrary values from stack) */
@@ -2832,6 +2865,7 @@ START_TEST(misc)
         test_MkParseDisplayNameEx();
         test_IsValidURL();
         test_bsc_marshaling();
+        test_URLDownloadToCacheFile();
         test_MapBrowserEmulationModeToUserAgent(TRUE);
     }
 
-- 
GitLab


https://gitlab.winehq.org/wine/wine/-/merge_requests/11255