From 4990ca0ea342bd115a9a46047b3b2de599cb916e Mon Sep 17 00:00:00 2001 From: Hans Leidekker Date: Tue, 17 Nov 2009 15:59:52 +0100 Subject: [PATCH] wininet: Avoid a crash on NULL lpcszHeader in HttpSendRequestExW. --- dlls/wininet/http.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/dlls/wininet/http.c b/dlls/wininet/http.c index 1426439c097..36037616123 100644 --- a/dlls/wininet/http.c +++ b/dlls/wininet/http.c @@ -3338,17 +3338,21 @@ BOOL WINAPI HttpSendRequestExW(HINTERNET hRequest, req = &workRequest.u.HttpSendRequestW; if (lpBuffersIn) { - DWORD size; + DWORD size = 0; - if (lpBuffersIn->dwHeadersLength == ~0u) - size = (strlenW( lpBuffersIn->lpcszHeader ) + 1) * sizeof(WCHAR); - else - size = lpBuffersIn->dwHeadersLength * sizeof(WCHAR); + if (lpBuffersIn->lpcszHeader) + { + if (lpBuffersIn->dwHeadersLength == ~0u) + size = (strlenW( lpBuffersIn->lpcszHeader ) + 1) * sizeof(WCHAR); + else + size = lpBuffersIn->dwHeadersLength * sizeof(WCHAR); - req->lpszHeader = HeapAlloc( GetProcessHeap(), 0, size ); - memcpy( req->lpszHeader, lpBuffersIn->lpcszHeader, size ); + req->lpszHeader = HeapAlloc( GetProcessHeap(), 0, size ); + memcpy( req->lpszHeader, lpBuffersIn->lpcszHeader, size ); + } + else req->lpszHeader = NULL; - req->dwHeaderLength = lpBuffersIn->dwHeadersLength; + req->dwHeaderLength = size / sizeof(WCHAR); req->lpOptional = lpBuffersIn->lpvBuffer; req->dwOptionalLength = lpBuffersIn->dwBufferLength; req->dwContentLength = lpBuffersIn->dwBufferTotal;