From: Jiajin Cui <cuijiajin@uniontech.com> Add coverage for URLDownloadToCacheFileW and URLDownloadToCacheFileA with long URL extensions to verify output buffers are not overrun. Signed-off-by: Jiajin Cui <cuijiajin@uniontech.com> --- dlls/urlmon/tests/misc.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/dlls/urlmon/tests/misc.c b/dlls/urlmon/tests/misc.c index 2a61b892930..8cfe7fec6ee 100644 --- a/dlls/urlmon/tests/misc.c +++ b/dlls/urlmon/tests/misc.c @@ -28,6 +28,7 @@ #include "winbase.h" #include "ole2.h" #include "urlmon.h" +#include "wininet.h" #include "initguid.h" @@ -2725,6 +2726,38 @@ static void test_bsc_marshaling(void) TerminateThread(thread, 0); } +static void test_URLDownloadToCacheFile(void) +{ + WCHAR url[512], filename[MAX_PATH]; + static const WCHAR prefix[] = L"http://127.0.0.1:1/test."; + char urlA[ARRAY_SIZE(url)], filenameA[MAX_PATH]; + DWORD size; + HRESULT hres; + BOOL ret; + unsigned int i, len; + + lstrcpyW(url, prefix); + len = lstrlenW(url); + for(i = len; i < ARRAY_SIZE(url) - 1; i++) + url[i] = 'a'; + url[i] = 0; + + memset(filename, 0xcc, sizeof(filename)); + hres = URLDownloadToCacheFileW(NULL, url, filename, ARRAY_SIZE(filename), 0, NULL); + ok(FAILED(hres), "URLDownloadToCacheFileW returned %#lx\n", hres); + ok(filename[ARRAY_SIZE(filename) - 1] == 0xcccc, "filename buffer overflowed\n"); + + WideCharToMultiByte(CP_ACP, 0, url, -1, urlA, sizeof(urlA), NULL, NULL); + size = 0; + ret = GetUrlCacheEntryInfoA(urlA, NULL, &size); + ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND, "cache entry was not deleted, error %ld\n", GetLastError()); + + memset(filenameA, 0xcc, sizeof(filenameA)); + hres = URLDownloadToCacheFileA(NULL, urlA, filenameA, sizeof(filenameA), 0, NULL); + ok(FAILED(hres), "URLDownloadToCacheFileA returned %#lx\n", hres); + ok(filenameA[sizeof(filenameA) - 1] == (char)0xcc, "filenameA buffer overflowed\n"); +} + static void test_MapBrowserEmulationModeToUserAgent(BOOL custom_ua) { /* Undocumented structure of unknown size, crashes if it's too small (with arbitrary values from stack) */ @@ -2832,6 +2865,7 @@ START_TEST(misc) test_MkParseDisplayNameEx(); test_IsValidURL(); test_bsc_marshaling(); + test_URLDownloadToCacheFile(); test_MapBrowserEmulationModeToUserAgent(TRUE); } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/11255