[PATCH v3 0/1] MR7363: http.sys: Avoid crashes in complete_irp() if http header value is space

[Wei Xie (＠wayne)]

The value_len returned by the parse_header function may be less than 0

--
  v3: http.sys: Avoid crashes in complete_irp() if http header value is space

https://gitlab.winehq.org/wine/wine/-/merge_requests/7363

[PATCH v3 1/1] http.sys: Avoid crashes in complete_irp() if http header value is space

[Wei Xie]

From: Wei Xie

The value_len returned by the parse_header function may be less than 0
---
 dlls/http.sys/http.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/http.sys/http.c b/dlls/http.sys/http.c
index edf099b43ab..dfbbc1e0389 100644
--- a/dlls/http.sys/http.c
+++ b/dlls/http.sys/http.c
@@ -267,8 +267,8 @@ static void parse_header(const char *name, int *name_len, const char **value, in
     while (*p == ' ' || *p == '\t') ++p;
     *value = p;
     while (isprint(*p) || *p == '\t') ++p;
-    while (isspace(*p)) --p; /* strip trailing LWS */
-    *value_len = p - *value + 1;
+    while (p > *value && isspace(p[-1])) --p; /* strip trailing LWS */
+    *value_len = p - *value;
 }

#define http_unknown_header http_unknown_header_64

[Wei Xie (＠wayne)]

I've resubmitted the code

[PATCH v3 0/1] MR7363: http.sys: Avoid crashes in complete_irp() if http header value is space - approved

[Elizabeth Figura (＠zfigura)]

This merge request was approved by Elizabeth Figura.