Signed-off-by: Connor McAdams <cmcadams(a)codeweavers.com>
---
-v2: Resend, first series was sent before the testbot had updated the
build tree to the latest master.
---
dlls/webservices/channel.c | 16 ++++++++++------
dlls/webservices/string.c | 5 ++++-
dlls/webservices/webservices_private.h | 4 +++-
3 files changed, 17 insertions(+), 8 deletions(-)
diff --git a/dlls/webservices/channel.c b/dlls/webservices/channel.c
index 4941844afe5..325e842635b 100644
--- a/dlls/webservices/channel.c
+++ b/dlls/webservices/channel.c
@@ -327,8 +327,8 @@ static void reset_channel( struct channel *channel )
channel->state = WS_CHANNEL_STATE_CREATED;
channel->session_state = SESSION_STATE_UNINITIALIZED;
clear_addr( &channel->addr );
- clear_dict( &channel->dict_send );
- clear_dict( &channel->dict_recv );
+ init_dict( &channel->dict_send, channel->dict_size );
+ init_dict( &channel->dict_recv, 0 );
channel->msg = NULL;
channel->read_size = 0;
channel->send_size = 0;
@@ -485,6 +485,7 @@ static HRESULT create_channel( WS_CHANNEL_TYPE type, WS_CHANNEL_BINDING binding,
channel->u.tcp.socket = -1;
channel->encoding = WS_ENCODING_XML_BINARY_SESSION_1;
channel->dict_size = 2048;
+ channel->dict_send.str_bytes_max = channel->dict_size;
break;
case WS_UDP_CHANNEL_BINDING:
@@ -544,6 +545,7 @@ static HRESULT create_channel( WS_CHANNEL_TYPE type, WS_CHANNEL_BINDING binding,
}
channel->dict_size = *(ULONG *)prop->value;
+ channel->dict_send.str_bytes_max = channel->dict_size;
break;
default:
@@ -1615,6 +1617,7 @@ static HRESULT CALLBACK dict_cb( void *state, const WS_XML_STRING *str, BOOL *fo
return S_OK;
}
+ if ((str->length + dict->str_bytes + 1) > dict->str_bytes_max) goto exit;
if (!(bytes = malloc( str->length ))) return E_OUTOFMEMORY;
memcpy( bytes, str->bytes, str->length );
if ((hr = insert_string( dict, bytes, str->length, index, id )) == S_OK)
@@ -1624,6 +1627,7 @@ static HRESULT CALLBACK dict_cb( void *state, const WS_XML_STRING *str, BOOL *fo
}
free( bytes );
+exit:
*found = FALSE;
return hr;
}
@@ -2184,12 +2188,12 @@ static HRESULT build_dict( const BYTE *buf, ULONG buflen, struct dictionary *dic
{
if ((hr = read_size( &ptr, buflen, &size )) != S_OK)
{
- clear_dict( dict );
+ init_dict( dict, 0 );
return hr;
}
if (size > buflen)
{
- clear_dict( dict );
+ init_dict( dict, 0 );
return WS_E_INVALID_FORMAT;
}
buflen -= size;
@@ -2208,7 +2212,7 @@ static HRESULT build_dict( const BYTE *buf, ULONG buflen, struct dictionary *dic
if ((hr = insert_string( dict, bytes, size, index, NULL )) != S_OK)
{
free( bytes );
- clear_dict( dict );
+ init_dict( dict, 0 );
return hr;
}
ptr += size;
@@ -2216,7 +2220,7 @@ static HRESULT build_dict( const BYTE *buf, ULONG buflen, struct dictionary *dic
return S_OK;
error:
- clear_dict( dict );
+ init_dict( dict, 0 );
return hr;
}
diff --git a/dlls/webservices/string.c b/dlls/webservices/string.c
index 3ecdcea85a4..34e67101e66 100644
--- a/dlls/webservices/string.c
+++ b/dlls/webservices/string.c
@@ -131,7 +131,7 @@ static HRESULT grow_dict( struct dictionary *dict, ULONG size )
return S_OK;
}
-void clear_dict( struct dictionary *dict )
+void init_dict( struct dictionary *dict, ULONG str_bytes_max )
{
ULONG i;
assert( !dict->dict.isConst );
@@ -145,6 +145,8 @@ void clear_dict( struct dictionary *dict )
dict->sequence = NULL;
dict->current_sequence = 0;
dict->size = 0;
+ dict->str_bytes = 0;
+ dict->str_bytes_max = str_bytes_max;
}
HRESULT insert_string( struct dictionary *dict, unsigned char *data, ULONG len, int i, ULONG *ret_id )
@@ -162,6 +164,7 @@ HRESULT insert_string( struct dictionary *dict, unsigned char *data, ULONG len,
dict->dict.strings[id].dictionary = &dict->dict;
dict->dict.strings[id].id = id;
dict->dict.stringCount++;
+ dict->str_bytes += len + 1;
dict->sequence[id] = dict->current_sequence;
diff --git a/dlls/webservices/webservices_private.h b/dlls/webservices/webservices_private.h
index b352aa52d49..373ab6799a9 100644
--- a/dlls/webservices/webservices_private.h
+++ b/dlls/webservices/webservices_private.h
@@ -49,13 +49,15 @@ struct dictionary
ULONG size;
ULONG current_sequence;
ULONG *sequence;
+ ULONG str_bytes;
+ ULONG str_bytes_max;
};
extern struct dictionary dict_builtin DECLSPEC_HIDDEN;
extern const struct dictionary dict_builtin_static DECLSPEC_HIDDEN;
int find_string( const struct dictionary *, const unsigned char *, ULONG, ULONG * ) DECLSPEC_HIDDEN;
HRESULT insert_string( struct dictionary *, unsigned char *, ULONG, int, ULONG * ) DECLSPEC_HIDDEN;
-void clear_dict( struct dictionary * ) DECLSPEC_HIDDEN;
+void init_dict( struct dictionary *, ULONG ) DECLSPEC_HIDDEN;
HRESULT writer_set_lookup( WS_XML_WRITER *, BOOL ) DECLSPEC_HIDDEN;
HRESULT writer_set_dict_callback( WS_XML_WRITER *, WS_DYNAMIC_STRING_CALLBACK, void * ) DECLSPEC_HIDDEN;
--
2.25.1