From: Jacek Caban <jacek@codeweavers.com>
Subject: ieframe: Allow any VT_ARRAY type as post data.
Message-Id: <555DB9EF.3020602@codeweavers.com>
Date: Thu, 21 May 2015 12:56:47 +0200

---
 dlls/ieframe/navigate.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/dlls/ieframe/navigate.c b/dlls/ieframe/navigate.c
index 9c5b88a..2eaf200 100644
--- a/dlls/ieframe/navigate.c
+++ b/dlls/ieframe/navigate.c
@@ -944,6 +944,7 @@ static void navigate_bsc_proc(DocHost *This, task_header_t *t)
 HRESULT navigate_url(DocHost *This, LPCWSTR url, const VARIANT *Flags,
                      const VARIANT *TargetFrameName, VARIANT *PostData, VARIANT *Headers)
 {
+    SAFEARRAY *post_array = NULL;
     PBYTE post_data = NULL;
     ULONG post_data_len = 0;
     LPWSTR headers = NULL;
@@ -955,9 +956,18 @@ HRESULT navigate_url(DocHost *This, LPCWSTR url, const VARIANT *Flags,
        || (TargetFrameName && V_VT(TargetFrameName) != VT_EMPTY && V_VT(TargetFrameName) != VT_ERROR))
         FIXME("Unsupported args (Flags %s; TargetFrameName %s)\n", debugstr_variant(Flags), debugstr_variant(TargetFrameName));
 
-    if(PostData && V_VT(PostData) == (VT_ARRAY | VT_UI1) && V_ARRAY(PostData)) {
-        SafeArrayAccessData(V_ARRAY(PostData), (void**)&post_data);
-        post_data_len = V_ARRAY(PostData)->rgsabound[0].cElements;
+    if(PostData) {
+        if(V_VT(PostData) & VT_ARRAY)
+            post_array = V_ISBYREF(PostData) ? *V_ARRAYREF(PostData) : V_ARRAY(PostData);
+        else
+            WARN("Invalid post data %s\n", debugstr_variant(PostData));
+    }
+
+    if(post_array) {
+        LONG elem_max;
+        SafeArrayAccessData(post_array, (void**)&post_data);
+        SafeArrayGetUBound(post_array, 1, &elem_max);
+        post_data_len = (elem_max+1) * SafeArrayGetElemsize(post_array);
     }
 
     if(Headers && V_VT(Headers) == VT_BSTR) {
@@ -996,7 +1006,7 @@ HRESULT navigate_url(DocHost *This, LPCWSTR url, const VARIANT *Flags,
     }
 
     if(post_data)
-        SafeArrayUnaccessData(V_ARRAY(PostData));
+        SafeArrayUnaccessData(post_array);
 
     return hres;
 }