[PATCH v2 0/1] MR8228: mshtml: Fix misuse of IWinInetHttpInfo_QueryInfo.

[Yuxuan Shui (＠yshui)]

IWinInetHttpInfo_QueryInfo returns a multibyte string, not a wide string. We
were also wrongly expecting it to have a NUL terminator.

* * *

this one doesn't feel good. IWinInetHttpInfo_QueryInfo calls HttpInfo_QueryInfo (urlmon), which calls HttpQueryInfoA (wininet), so it returns char*. but inside, HttpQueryInfoA is calling HttpQueryInfoW and does charset conversion. so we are converting the string to multibyte and back.

maybe there's an API that returns wchar* i don't know about.

--
  v2: mshtml: Fix misuse of IWinInetHttpInfo_QueryInfo.

https://gitlab.winehq.org/wine/wine/-/merge_requests/8228

[PATCH v2 1/1] mshtml: Fix misuse of IWinInetHttpInfo_QueryInfo.

[Yuxuan Shui]

From: Yuxuan Shui

IWinInetHttpInfo_QueryInfo returns a multibyte string, not a wide string. We
were also wrongly expecting it to have a NUL terminator.
---
 dlls/mshtml/navigate.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c
index 6b5eff15105..7e267975916 100644
--- a/dlls/mshtml/navigate.c
+++ b/dlls/mshtml/navigate.c
@@ -813,8 +813,9 @@ static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers
 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 {
     const WCHAR *ptr;
-    DWORD len = 0;
-    WCHAR *buf;
+    DWORD len = 0, wlen;
+    WCHAR *wbuf;
+    char *buf;

IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
     if(!len)
@@ -825,17 +826,29 @@ static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
         return;

IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
-    if(!len) {
-        free(buf);
-        return;
-    }
+    if(!len)
+        goto out;
+
+
+    wlen = MultiByteToWideChar(CP_ACP, 0, buf, len, NULL, 0);
+    if (!wlen)
+        goto out;
+
+    wbuf = malloc((wlen + 1) * sizeof(WCHAR));
+    if (!wbuf)
+        goto out;
+
+    MultiByteToWideChar(CP_ACP, 0, buf, len, wbuf, wlen);
+    wbuf[wlen] = L'\0';

-    ptr = wcschr(buf, '\r');
+    ptr = wcschr(wbuf, '\r');
     if(ptr && ptr[1] == '\n') {
         ptr += 2;
         process_response_headers(This, ptr);
     }
+    free(wbuf);

+out:
     free(buf);
 }

[Yuxuan Shui (＠yshui)]

update: fixed the new out-of-bound i just added.