From: Jacek Caban <jacek@codeweavers.com>
Subject: shlwapi: Make sure we don't write anything to output buffer if its size is too small to store the whole result
Message-Id: <4E98556F.9000701@codeweavers.com>
Date: Fri, 14 Oct 2011 17:29:51 +0200

---
  dlls/shlwapi/tests/url.c |   11 +++++++++++
  dlls/shlwapi/url.c       |   16 ++++++----------
  2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/dlls/shlwapi/tests/url.c b/dlls/shlwapi/tests/url.c
index 1ef2aab..29d0cff 100644
--- a/dlls/shlwapi/tests/url.c
+++ b/dlls/shlwapi/tests/url.c
@@ -882,16 +882,27 @@ static void test_UrlEscape(void)
     ok(size == 1, "got %d, expected %d\n", size, 1);
 
     size = 1;
+    empty_string[0] = 127;
     ret = pUrlEscapeA("/woningplan/woonkamer basis.swf", empty_string, &size, URL_ESCAPE_SPACES_ONLY);
     ok(ret == E_POINTER, "got %x, expected %x\n", ret, E_POINTER);
     ok(size == 34, "got %d, expected %d\n", size, 34);
+    ok(empty_string[0] == 127, "String has changed, empty_string[0] = %d\n", empty_string[0]);
 
     if(pUrlEscapeW) {
+        WCHAR wc;
+
         size = sizeof(overwrite)/sizeof(WCHAR);
         ret = pUrlEscapeW(overwrite, overwrite, &size, URL_ESCAPE_SPACES_ONLY);
         ok(ret == S_OK, "got %x, expected S_OK\n", ret);
         ok(size == 9, "got %d, expected 9\n", size);
         ok(!lstrcmpW(overwrite, out), "got %s, expected %s\n", wine_dbgstr_w(overwrite), wine_dbgstr_w(out));
+
+        size = 1;
+        wc = 127;
+        ret = pUrlEscapeW(overwrite, &wc, &size, URL_ESCAPE_SPACES_ONLY);
+        ok(ret == E_POINTER, "got %x, expected %x\n", ret, E_POINTER);
+        ok(size == 10, "got %d, expected 9\n", size);
+        ok(wc == 127, "String has changed, wc = %d\n", wc);
     }
 
     for(i=0; i<sizeof(TEST_ESCAPE)/sizeof(TEST_ESCAPE[0]); i++) {
diff --git a/dlls/shlwapi/url.c b/dlls/shlwapi/url.c
index 0c68529..bcd413c 100644
--- a/dlls/shlwapi/url.c
+++ b/dlls/shlwapi/url.c
@@ -1072,7 +1072,7 @@ HRESULT WINAPI UrlEscapeW(
     LPCWSTR src;
     DWORD needed = 0, ret;
     BOOL stop_escaping = FALSE;
-    WCHAR next[5], *dst = pszEscaped, *dst_ptr = NULL;
+    WCHAR next[5], *dst, *dst_ptr;
     INT len;
     PARSEDURLW parsed_url;
     DWORD int_flags;
@@ -1091,11 +1091,9 @@ HRESULT WINAPI UrlEscapeW(
 		   URL_ESCAPE_PERCENT))
         FIXME("Unimplemented flags: %08x\n", dwFlags);
 
-    if(pszUrl == pszEscaped) {
-        dst_ptr = dst = HeapAlloc(GetProcessHeap(), 0, *pcchEscaped*sizeof(WCHAR));
-        if(!dst)
-            return E_OUTOFMEMORY;
-    }
+    dst_ptr = dst = HeapAlloc(GetProcessHeap(), 0, *pcchEscaped*sizeof(WCHAR));
+    if(!dst_ptr)
+        return E_OUTOFMEMORY;
 
     /* fix up flags */
     if (dwFlags & URL_ESCAPE_SPACES_ONLY)
@@ -1213,8 +1211,7 @@ HRESULT WINAPI UrlEscapeW(
 
     if(needed < *pcchEscaped) {
         *dst = '\0';
-        if(pszUrl == pszEscaped)
-            memcpy(pszEscaped, dst-needed, (needed+1)*sizeof(WCHAR));
+        memcpy(pszEscaped, dst_ptr, (needed+1)*sizeof(WCHAR));
 
         ret = S_OK;
     } else {
@@ -1223,8 +1220,7 @@ HRESULT WINAPI UrlEscapeW(
     }
     *pcchEscaped = needed;
 
-    if(pszUrl == pszEscaped)
-        HeapFree(GetProcessHeap(), 0, dst_ptr);
+    HeapFree(GetProcessHeap(), 0, dst_ptr);
     return ret;
 }