Kusanagi Kouichi : winex11.drv: Fix crash by long preedit text.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 53b9a53c27fcb43689015dbfc9fbf3ee0137ea78
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=53b9a53c27fcb43689015dbfc9...

Author: Kusanagi Kouichi 
Date:   Fri Mar 21 04:52:49 2008 +0900

winex11.drv: Fix crash by long preedit text.

---

dlls/winex11.drv/xim.c |   24 ++++++++++++++++--------
 1 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/dlls/winex11.drv/xim.c b/dlls/winex11.drv/xim.c
index a586af2..ad28bc5 100644
--- a/dlls/winex11.drv/xim.c
+++ b/dlls/winex11.drv/xim.c
@@ -293,9 +293,6 @@ static void XIMPreEditDoneCallback(XIC ic, XPointer client_data, XPointer call_d
 static void XIMPreEditDrawCallback(XIM ic, XPointer client_data,
                                    XIMPreeditDrawCallbackStruct *P_DR)
 {
-    DWORD dwOutput;
-    WCHAR wcOutput[64];
-
     TRACE("PreEditDrawCallback %p\n",ic);

if (P_DR)
@@ -306,14 +303,25 @@ static void XIMPreEditDrawCallback(XIM ic, XPointer client_data,
         {
             if (! P_DR->text->encoding_is_wchar)
             {
+                DWORD dwOutput;
+                WCHAR *wcOutput;
+
                 TRACE("multibyte\n");
                 dwOutput = MultiByteToWideChar(CP_UNIXCP, 0,
                            P_DR->text->string.multi_byte, -1,
-                           wcOutput, 64);
-
-                /* ignore null */
-                dwOutput --;
-                X11DRV_ImmSetInternalString (GCS_COMPSTR, sel, len, wcOutput, dwOutput);
+                           NULL, 0);
+                wcOutput = HeapAlloc(GetProcessHeap(), 0, sizeof (WCHAR) * dwOutput);
+                if (wcOutput)
+                {
+                    dwOutput = MultiByteToWideChar(CP_UNIXCP, 0,
+                               P_DR->text->string.multi_byte, -1,
+                               wcOutput, dwOutput);
+
+                    /* ignore null */
+                    dwOutput --;
+                    X11DRV_ImmSetInternalString (GCS_COMPSTR, sel, len, wcOutput, dwOutput);
+                    HeapFree(GetProcessHeap(), 0, wcOutput);
+                }
             }
             else
             {