Phil Lodwick : wininet: ftp: Fix crash if input buffer is larger than MAX_PATH.

[Alexandre Julliard]

Module: wine
Branch: refs/heads/master
Commit: 3575918411599be393cf0872c192cd8e8ea5cc57
URL:    http://source.winehq.org/git/?p=wine.git;a=commit;h=3575918411599be393cf0872...

Author: Phil Lodwick 
Date:   Wed Jun  7 14:35:16 2006 -0500

wininet: ftp: Fix crash if input buffer is larger than MAX_PATH.

---

dlls/wininet/ftp.c |   19 ++++++++++++++++---
 1 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/dlls/wininet/ftp.c b/dlls/wininet/ftp.c
index 828f1e5..0970c95 100644
--- a/dlls/wininet/ftp.c
+++ b/dlls/wininet/ftp.c
@@ -746,16 +746,29 @@ lend:
 BOOL WINAPI FtpGetCurrentDirectoryA(HINTERNET hFtpSession, LPSTR lpszCurrentDirectory,
     LPDWORD lpdwCurrentDirectory)
 {
-    WCHAR dir[MAX_PATH];
+    WCHAR *dir = NULL;
     DWORD len;
     BOOL ret;

-    if(lpdwCurrentDirectory) len = *lpdwCurrentDirectory;
+    if(lpdwCurrentDirectory) {
+        len = *lpdwCurrentDirectory;
+        if(lpszCurrentDirectory)
+        {
+            dir = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
+            if (NULL == dir)
+            {
+                INTERNET_SetLastError(ERROR_OUTOFMEMORY);
+                return FALSE;
+            }
+        }
+    }
     ret = FtpGetCurrentDirectoryW(hFtpSession, lpszCurrentDirectory?dir:NULL, lpdwCurrentDirectory?&len:NULL);
     if(lpdwCurrentDirectory) {
         *lpdwCurrentDirectory = len;
-        if(lpszCurrentDirectory)
+        if(lpszCurrentDirectory) { 
             WideCharToMultiByte(CP_ACP, 0, dir, len, lpszCurrentDirectory, *lpdwCurrentDirectory, NULL, NULL);
+            HeapFree(GetProcessHeap(), 0, dir);
+        }
     }
     return ret;
 }