Jacek Caban : shlwapi: Make sure we don' t write anything to output buffer if its size is too small to store the whole result .

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 4a39433eaee04182a08277b8ca2f208b46a11212
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=4a39433eaee04182a08277b8ca...

Author: Jacek Caban 
Date:   Fri Oct 14 17:29:51 2011 +0200

shlwapi: Make sure we don't write anything to output buffer if its size is too small to store the whole result.

---

dlls/shlwapi/tests/url.c |   11 +++++++++++
 dlls/shlwapi/url.c       |   16 ++++++----------
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/dlls/shlwapi/tests/url.c b/dlls/shlwapi/tests/url.c
index 1ef2aab..29d0cff 100644
--- a/dlls/shlwapi/tests/url.c
+++ b/dlls/shlwapi/tests/url.c
@@ -882,16 +882,27 @@ static void test_UrlEscape(void)
     ok(size == 1, "got %d, expected %d\n", size, 1);

size = 1;
+    empty_string[0] = 127;
     ret = pUrlEscapeA("/woningplan/woonkamer basis.swf", empty_string, &size, URL_ESCAPE_SPACES_ONLY);
     ok(ret == E_POINTER, "got %x, expected %x\n", ret, E_POINTER);
     ok(size == 34, "got %d, expected %d\n", size, 34);
+    ok(empty_string[0] == 127, "String has changed, empty_string[0] = %d\n", empty_string[0]);

if(pUrlEscapeW) {
+        WCHAR wc;
+
         size = sizeof(overwrite)/sizeof(WCHAR);
         ret = pUrlEscapeW(overwrite, overwrite, &size, URL_ESCAPE_SPACES_ONLY);
         ok(ret == S_OK, "got %x, expected S_OK\n", ret);
         ok(size == 9, "got %d, expected 9\n", size);
         ok(!lstrcmpW(overwrite, out), "got %s, expected %s\n", wine_dbgstr_w(overwrite), wine_dbgstr_w(out));
+
+        size = 1;
+        wc = 127;
+        ret = pUrlEscapeW(overwrite, &wc, &size, URL_ESCAPE_SPACES_ONLY);
+        ok(ret == E_POINTER, "got %x, expected %x\n", ret, E_POINTER);
+        ok(size == 10, "got %d, expected 9\n", size);
+        ok(wc == 127, "String has changed, wc = %d\n", wc);
     }

for(i=0; i<sizeof(TEST_ESCAPE)/sizeof(TEST_ESCAPE[0]); i++) {
diff --git a/dlls/shlwapi/url.c b/dlls/shlwapi/url.c
index 0c68529..bcd413c 100644
--- a/dlls/shlwapi/url.c
+++ b/dlls/shlwapi/url.c
@@ -1072,7 +1072,7 @@ HRESULT WINAPI UrlEscapeW(
     LPCWSTR src;
     DWORD needed = 0, ret;
     BOOL stop_escaping = FALSE;
-    WCHAR next[5], *dst = pszEscaped, *dst_ptr = NULL;
+    WCHAR next[5], *dst, *dst_ptr;
     INT len;
     PARSEDURLW parsed_url;
     DWORD int_flags;
@@ -1091,11 +1091,9 @@ HRESULT WINAPI UrlEscapeW(
    	   URL_ESCAPE_PERCENT))
         FIXME("Unimplemented flags: %08x\n", dwFlags);

-    if(pszUrl == pszEscaped) {
-        dst_ptr = dst = HeapAlloc(GetProcessHeap(), 0, *pcchEscaped*sizeof(WCHAR));
-        if(!dst)
-            return E_OUTOFMEMORY;
-    }
+    dst_ptr = dst = HeapAlloc(GetProcessHeap(), 0, *pcchEscaped*sizeof(WCHAR));
+    if(!dst_ptr)
+        return E_OUTOFMEMORY;

/* fix up flags */
     if (dwFlags & URL_ESCAPE_SPACES_ONLY)
@@ -1213,8 +1211,7 @@ HRESULT WINAPI UrlEscapeW(

if(needed < *pcchEscaped) {
         *dst = '\0';
-        if(pszUrl == pszEscaped)
-            memcpy(pszEscaped, dst-needed, (needed+1)*sizeof(WCHAR));
+        memcpy(pszEscaped, dst_ptr, (needed+1)*sizeof(WCHAR));

ret = S_OK;
     } else {
@@ -1223,8 +1220,7 @@ HRESULT WINAPI UrlEscapeW(
     }
     *pcchEscaped = needed;

-    if(pszUrl == pszEscaped)
-        HeapFree(GetProcessHeap(), 0, dst_ptr);
+    HeapFree(GetProcessHeap(), 0, dst_ptr);
     return ret;
 }