[PATCH 0/1] MR7363: http.sys: Avoid crashes in complete_irp() if http header value is space

[Wei Xie (＠wayne)]

The value_len returned by the parse_header function may be less than 0

[PATCH 1/1] http.sys: Avoid crashes in complete_irp() if http header value is space

[Wei Xie]

From: Wei Xie

The value_len returned by the parse_header function may be less than 0
---
 dlls/http.sys/http.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/http.sys/http.c b/dlls/http.sys/http.c
index edf099b43ab..352d95d3391 100644
--- a/dlls/http.sys/http.c
+++ b/dlls/http.sys/http.c
@@ -267,8 +267,8 @@ static void parse_header(const char *name, int *name_len, const char **value, in
     while (*p == ' ' || *p == '\t') ++p;
     *value = p;
     while (isprint(*p) || *p == '\t') ++p;
-    while (isspace(*p)) --p; /* strip trailing LWS */
-    *value_len = p - *value + 1;
+    while (p > *value && isspace(*p)) --p; /* strip trailing LWS */
+    *value_len = p - *value;
 }

#define http_unknown_header http_unknown_header_64

[Elizabeth Figura (＠zfigura)]

Sorry, I messed it up, it should still be "p - *value + 1".

[Elizabeth Figura (＠zfigura)]

Eh, the idiomatic thing to write would be

```
while (isprint(*p) || *p == '\t') ++p;
while (p > *value && isspace(p[-1]) --p;
*value_len = p - *value;
```

That way after each line p points to the character after the end.