Commit bd805297 authored by Hans Leidekker's avatar Hans Leidekker Committed by Alexandre Julliard

wininet: Add an exception handler in HttpOpenRequestA to protect against invalid…

wininet: Add an exception handler in HttpOpenRequestA to protect against invalid accept type pointers.
parent cd434dd9
...@@ -59,6 +59,7 @@ ...@@ -59,6 +59,7 @@
#include "internet.h" #include "internet.h"
#include "wine/debug.h" #include "wine/debug.h"
#include "wine/exception.h"
#include "wine/unicode.h" #include "wine/unicode.h"
WINE_DEFAULT_DEBUG_CHANNEL(wininet); WINE_DEFAULT_DEBUG_CHANNEL(wininet);
...@@ -1020,12 +1021,20 @@ HINTERNET WINAPI HttpOpenRequestA(HINTERNET hHttpSession, ...@@ -1020,12 +1021,20 @@ HINTERNET WINAPI HttpOpenRequestA(HINTERNET hHttpSession,
types = lpszAcceptTypes; types = lpszAcceptTypes;
while (*types) while (*types)
{ {
/* find out how many there are */ __TRY
if (((ULONG_PTR)*types >> 16) && **types)
{ {
TRACE("accept type: %s\n", debugstr_a(*types)); /* find out how many there are */
acceptTypesCount++; if (*types && **types)
{
TRACE("accept type: %s\n", debugstr_a(*types));
acceptTypesCount++;
}
}
__EXCEPT_PAGE_FAULT
{
WARN("invalid accept type pointer\n");
} }
__ENDTRY;
types++; types++;
} }
szAcceptTypes = HeapAlloc(GetProcessHeap(), 0, sizeof(WCHAR *) * (acceptTypesCount+1)); szAcceptTypes = HeapAlloc(GetProcessHeap(), 0, sizeof(WCHAR *) * (acceptTypesCount+1));
...@@ -1035,20 +1044,26 @@ HINTERNET WINAPI HttpOpenRequestA(HINTERNET hHttpSession, ...@@ -1035,20 +1044,26 @@ HINTERNET WINAPI HttpOpenRequestA(HINTERNET hHttpSession,
types = lpszAcceptTypes; types = lpszAcceptTypes;
while (*types) while (*types)
{ {
if (((ULONG_PTR)*types >> 16) && **types) __TRY
{ {
len = MultiByteToWideChar(CP_ACP, 0, *types, -1, NULL, 0 ); if (*types && **types)
szAcceptTypes[acceptTypesCount] = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR)); {
if (!szAcceptTypes[acceptTypesCount]) goto end; len = MultiByteToWideChar(CP_ACP, 0, *types, -1, NULL, 0 );
szAcceptTypes[acceptTypesCount] = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
MultiByteToWideChar(CP_ACP, 0, *types, -1, szAcceptTypes[acceptTypesCount], len); MultiByteToWideChar(CP_ACP, 0, *types, -1, szAcceptTypes[acceptTypesCount], len);
acceptTypesCount++; acceptTypesCount++;
}
}
__EXCEPT_PAGE_FAULT
{
/* ignore invalid pointer */
} }
__ENDTRY;
types++; types++;
} }
szAcceptTypes[acceptTypesCount] = NULL; szAcceptTypes[acceptTypesCount] = NULL;
} }
else szAcceptTypes = 0;
rc = HttpOpenRequestW(hHttpSession, szVerb, szObjectName, rc = HttpOpenRequestW(hHttpSession, szVerb, szObjectName,
szVersion, szReferrer, szVersion, szReferrer,
......
...@@ -1964,7 +1964,7 @@ static void test_user_agent_header(void) ...@@ -1964,7 +1964,7 @@ static void test_user_agent_header(void)
static void test_bogus_accept_types_array(void) static void test_bogus_accept_types_array(void)
{ {
HINTERNET ses, con, req; HINTERNET ses, con, req;
static const char *types[] = { (const char *)6240, "*/*", "%p", "", "*/*", NULL }; static const char *types[] = { (const char *)6240, "*/*", "%p", "", (const char *)0xffffffff, "*/*", NULL };
DWORD size; DWORD size;
char buffer[32]; char buffer[32];
BOOL ret; BOOL ret;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment