[PATCH 1/1] mshtml: Fix misuse of IWinInetHttpInfo_QueryInfo.

[Yuxuan Shui]

From: Yuxuan Shui

IWinInetHttpInfo_QueryInfo returns a multibyte string, not a wide string. We
were also wrongly expecting it to have a NUL terminator.
---
 dlls/mshtml/navigate.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c
index 6b5eff15105..91e7d673227 100644
--- a/dlls/mshtml/navigate.c
+++ b/dlls/mshtml/navigate.c
@@ -813,8 +813,9 @@ static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers
 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 {
     const WCHAR *ptr;
-    DWORD len = 0;
-    WCHAR *buf;
+    DWORD len = 0, wlen;
+    WCHAR *wbuf;
+    char *buf;

IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
     if(!len)
@@ -825,17 +826,29 @@ static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
         return;

IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
-    if(!len) {
-        free(buf);
-        return;
-    }
+    if(!len)
+        goto out;
+
+
+    wlen = MultiByteToWideChar(CP_ACP, 0, buf, len, NULL, 0) * sizeof(WCHAR);
+    if (!wlen)
+        goto out;
+
+    wbuf = malloc(wlen + sizeof(WCHAR));
+    if (!wbuf)
+        goto out;
+
+    MultiByteToWideChar(CP_ACP, 0, buf, len, wbuf, wlen / sizeof(WCHAR));
+    wbuf[wlen] = L'\0';

-    ptr = wcschr(buf, '\r');
+    ptr = wcschr(wbuf, '\r');
     if(ptr && ptr[1] == '\n') {
         ptr += 2;
         process_response_headers(This, ptr);
     }
+    free(wbuf);

+out:
     free(buf);
 }