Commit e3b28631 authored by Bernhard Übelacker's avatar Bernhard Übelacker Committed by Alexandre Julliard

hhctrl.ocx: Handle only the number of bytes given in html_fragment_len.

parent beb13143
...@@ -1898,14 +1898,14 @@ WCHAR *decode_html(const char *html_fragment, int html_fragment_len, UINT code_p ...@@ -1898,14 +1898,14 @@ WCHAR *decode_html(const char *html_fragment, int html_fragment_len, UINT code_p
while(1) while(1)
{ {
symbol = 0; symbol = 0;
amp = strchr(h, '&'); amp = memchr(h, '&', html_fragment + html_fragment_len - h);
if(!amp) break; if(!amp) break;
len = amp-h; len = amp-h;
/* Copy the characters prior to the HTML encoded character */ /* Copy the characters prior to the HTML encoded character */
memcpy(&tmp[tmp_len], h, len); memcpy(&tmp[tmp_len], h, len);
tmp_len += len; tmp_len += len;
amp++; /* skip ampersand */ amp++; /* skip ampersand */
sem = strchr(amp, ';'); sem = memchr(amp, ';', html_fragment + html_fragment_len - amp);
/* Require a semicolon after the ampersand */ /* Require a semicolon after the ampersand */
if(!sem) if(!sem)
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment