From feda40bbaab360edd09b1a36d75a52894b91bde6 Mon Sep 17 00:00:00 2001 From: Nikolay Sivov Date: Wed, 9 Oct 2013 15:38:02 +0400 Subject: [PATCH] xmllite: Fix overwriting of dest buffer when pushing more data to it. --- dlls/xmllite/reader.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dlls/xmllite/reader.c b/dlls/xmllite/reader.c index ad6544b1aff..ebea0b432ef 100644 --- a/dlls/xmllite/reader.c +++ b/dlls/xmllite/reader.c @@ -703,7 +703,7 @@ static HRESULT readerinput_growraw(xmlreaderinput *readerinput) read = 0; hr = ISequentialStream_Read(readerinput->stream, buffer->data + buffer->written, len, &read); - TRACE("requested %d, read %d, ret 0x%08x\n", len, read, hr); + TRACE("written=%d, alloc=%d, requested=%d, read=%d, ret=0x%08x\n", buffer->written, buffer->allocated, len, read, hr); readerinput->pending = hr == E_PENDING; if (FAILED(hr)) return hr; buffer->written += read; @@ -903,14 +903,14 @@ static HRESULT reader_more(xmlreader *reader) if (cp == ~0) { readerinput_grow(readerinput, len); - memcpy(dest->data, src->data + src->cur, len); + memcpy(dest->data + dest->written, src->data + src->cur, len); dest->written += len*sizeof(WCHAR); return hr; } dest_len = MultiByteToWideChar(cp, 0, src->data + src->cur, len, NULL, 0); readerinput_grow(readerinput, dest_len); - ptr = (WCHAR*)dest->data; + ptr = (WCHAR*)(dest->data + dest->written); MultiByteToWideChar(cp, 0, src->data + src->cur, len, ptr, dest_len); ptr[dest_len] = 0; dest->written += dest_len*sizeof(WCHAR); @@ -930,7 +930,7 @@ static inline WCHAR *reader_get_ptr(xmlreader *reader) encoded_buffer *buffer = &reader->input->buffer->utf16; WCHAR *ptr = (WCHAR*)buffer->data + buffer->cur; if (!*ptr) reader_more(reader); - return ptr; + return (WCHAR*)buffer->data + buffer->cur; } static int reader_cmp(xmlreader *reader, const WCHAR *str)