[PATCH v3 0/2] MR8346: wininet: Fix 2 out-of-bound problems in url cache hash calculation

[Yuxuan Shui (＠yshui)]

--
  v3: wininet: Use BYTE instead of char for hash calculation.

https://gitlab.winehq.org/wine/wine/-/merge_requests/8346

[PATCH v3 1/2] wininet: Fix handling of empty strings in urlcache_hash_key.

[Yuxuan Shui]

From: Yuxuan Shui

---
 dlls/wininet/urlcache.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/dlls/wininet/urlcache.c b/dlls/wininet/urlcache.c
index 7975071ce91..366fa0b6bea 100644
--- a/dlls/wininet/urlcache.c
+++ b/dlls/wininet/urlcache.c
@@ -1461,11 +1461,12 @@ static DWORD urlcache_hash_key(LPCSTR lpszKey)
     for (i = 0; i < ARRAY_SIZE(key); i++)
         key[i] = lookupTable[(*lpszKey + i) & 0xFF];

-    for (lpszKey++; *lpszKey; lpszKey++)
-    {
-        for (i = 0; i < ARRAY_SIZE(key); i++)
-            key[i] = lookupTable[*lpszKey ^ key[i]];
-    }
+    if (*lpszKey)
+        for (lpszKey++; *lpszKey; lpszKey++)
+        {
+            for (i = 0; i < ARRAY_SIZE(key); i++)
+                key[i] = lookupTable[*lpszKey ^ key[i]];
+        }

return *(DWORD *)key;
 }

[PATCH v3 2/2] wininet: Use BYTE instead of char for hash calculation.

[Yuxuan Shui]

From: Yuxuan Shui

Since LPCSTR is signed, (*lpszKey ^ key[i]) could be negative, which means
accessing the lookupTable with it will underflow.
---
 dlls/wininet/urlcache.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/dlls/wininet/urlcache.c b/dlls/wininet/urlcache.c
index 366fa0b6bea..49c8ce9becc 100644
--- a/dlls/wininet/urlcache.c
+++ b/dlls/wininet/urlcache.c
@@ -1455,17 +1455,18 @@ static DWORD urlcache_hash_key(LPCSTR lpszKey)
         0xA3, 0xC8, 0xDE, 0xEB, 0xF8, 0xF3, 0xDB, 0x0A,
         0x98, 0x83, 0x7B, 0xE5, 0xCB, 0x4C, 0x78, 0xD1
     };
+    const BYTE *input = (const BYTE *)lpszKey;
     BYTE key[4];
     DWORD i;

for (i = 0; i < ARRAY_SIZE(key); i++)
-        key[i] = lookupTable[(*lpszKey + i) & 0xFF];
+        key[i] = lookupTable[(*input + i) & 0xFF];

-    if (*lpszKey)
-        for (lpszKey++; *lpszKey; lpszKey++)
+    if (*input)
+        for (input++; *input; input++)
         {
             for (i = 0; i < ARRAY_SIZE(key); i++)
-                key[i] = lookupTable[*lpszKey ^ key[i]];
+                key[i] = lookupTable[*input ^ key[i]];
         }

return *(DWORD *)key;

[PATCH v3 0/2] MR8346: wininet: Fix 2 out-of-bound problems in url cache hash calculation - approved

[Jacek Caban (＠jacek)]

This merge request was approved by Jacek Caban.