Module: wine Branch: master Commit: b2c80e6b186079200875a936f853fffeb6967206 URL: http://source.winehq.org/git/wine.git/?a=commit;h=b2c80e6b186079200875a936f8...
Author: Jacek Caban jacek@codeweavers.com Date: Thu Apr 17 02:30:40 2008 +0200
mshtml: Make sure to null terminate buffer in parse_extern_script.
---
dlls/mshtml/mshtml_private.h | 2 +- dlls/mshtml/navigate.c | 3 ++- dlls/mshtml/script.c | 8 ++++++-- 3 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h index 2976fa8..6682370 100644 --- a/dlls/mshtml/mshtml_private.h +++ b/dlls/mshtml/mshtml_private.h @@ -411,7 +411,7 @@ void set_document_bscallback(HTMLDocument*,nsChannelBSC*); void set_current_mon(HTMLDocument*,IMoniker*); HRESULT start_binding(HTMLDocument*,BSCallback*,IBindCtx*);
-HRESULT bind_mon_to_buffer(HTMLDocument*,IMoniker*,void**); +HRESULT bind_mon_to_buffer(HTMLDocument*,IMoniker*,void**,DWORD*);
nsChannelBSC *create_channelbsc(IMoniker*); HRESULT channelbsc_load_stream(nsChannelBSC*,IStream*); diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c index 9ed1dea..78ae19d 100644 --- a/dlls/mshtml/navigate.c +++ b/dlls/mshtml/navigate.c @@ -807,7 +807,7 @@ static BufferBSC *create_bufferbsc(IMoniker *mon) return ret; }
-HRESULT bind_mon_to_buffer(HTMLDocument *doc, IMoniker *mon, void **buf) +HRESULT bind_mon_to_buffer(HTMLDocument *doc, IMoniker *mon, void **buf, DWORD *size) { BufferBSC *bsc = create_bufferbsc(mon); HRESULT hres; @@ -820,6 +820,7 @@ HRESULT bind_mon_to_buffer(HTMLDocument *doc, IMoniker *mon, void **buf) if(SUCCEEDED(hres)) { *buf = bsc->buf; bsc->buf = NULL; + *size = bsc->bsc.readed; bsc->size = 0; } } diff --git a/dlls/mshtml/script.c b/dlls/mshtml/script.c index 15a939c..412a3ec 100644 --- a/dlls/mshtml/script.c +++ b/dlls/mshtml/script.c @@ -477,6 +477,7 @@ static void parse_extern_script(ScriptHost *script_host, LPCWSTR src) IMoniker *mon; char *buf; WCHAR *text; + DWORD len, size=0; HRESULT hres;
static const WCHAR wine_schemaW[] = {'w','i','n','e',':'}; @@ -488,13 +489,16 @@ static void parse_extern_script(ScriptHost *script_host, LPCWSTR src) if(FAILED(hres)) return;
- hres = bind_mon_to_buffer(script_host->doc, mon, (void**)&buf); + hres = bind_mon_to_buffer(script_host->doc, mon, (void**)&buf, &size); IMoniker_Release(mon); if(FAILED(hres)) return;
- text = heap_strdupAtoW(buf); + len = MultiByteToWideChar(CP_ACP, 0, buf, size, NULL, 0); + text = heap_alloc((len+1)*sizeof(WCHAR)); + MultiByteToWideChar(CP_ACP, 0, buf, size, text, len); heap_free(buf); + text[len] = 0;
parse_text(script_host, text);