http://bugs.winehq.org/show_bug.cgi?id=29635
--- Comment #8 from cobaltjacket@gmail.com 2012-01-19 10:26:56 CST --- git diff diff --git a/dlls/winhttp/session.c b/dlls/winhttp/session.c index b4ed568..30844af 100644 --- a/dlls/winhttp/session.c +++ b/dlls/winhttp/session.c @@ -1949,7 +1949,7 @@ static BSTR download_script( HINTERNET ses, const WCHAR *url ) } len = MultiByteToWideChar( CP_ACP, 0, buffer, offset, NULL, 0 ); if (!(script = SysAllocStringLen( NULL, len ))) goto done; - MultiByteToWideChar( CP_ACP, 0, buffer, offset, script, len ); + MultiByteToWideChar( CP_ACP, 0, buffer, offset, script, 0 ); script[len] = 0;
done:
This change causes the crash to go away. It is obviously NOT a resolution to the problem (I think setting dstlen=0 in wine_cp_mbstowcs might causes the call to just return the length of the string (mbtowc.c:277) and not copy it to *dst, which seems to be the purpose of this line). Hopefully this helps someone who knows more about the mbs/wcs implementation get a start.