Re: [PATCH v2 0/5] MR399: XMLHttpRequest improvements

[Jacek Caban (＠jacek)]

Jacek Caban (@jacek) commented about dlls/mshtml/navigate.c:
>  static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
>
>  ptr = wcschr(value, ';');
> - for(end = ptr ? ptr : value + len; end > value; end--)
> -
>    if(!iswspace(end[-1]))
> -
>        break;
> - for(beg = value; beg < end; beg++)
> -
>    if(!iswspace(*beg))
> -
>        break;
> -
> - if((content_type = heap_strndupWtoU(beg, end - beg))) {
> -
>    heap_free(This->nschannel->content_type);
> -
>    This->nschannel->content_type = content_type;
> -
>    strlwr(content_type);
> - }

This can still unconditionally override a validated content content type.