From e222e88ac423ebe4e1c89b8486c2ff3b2d73e2bc Mon Sep 17 00:00:00 2001 From: Hans Leidekker Date: Wed, 20 Jun 2018 15:04:45 +0200 Subject: [PATCH] webservices: Avoid accessing the old user buffer in WsSetOutput/ToBuffer. Signed-off-by: Hans Leidekker Signed-off-by: Alexandre Julliard --- dlls/webservices/writer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dlls/webservices/writer.c b/dlls/webservices/writer.c index 9cba4e60a20..33c1be70b5e 100644 --- a/dlls/webservices/writer.c +++ b/dlls/webservices/writer.c @@ -39,7 +39,7 @@ static const struct prop_desc writer_props[] = { { sizeof(ULONG), FALSE }, /* WS_XML_WRITER_PROPERTY_MAX_DEPTH */ { sizeof(BOOL), FALSE }, /* WS_XML_WRITER_PROPERTY_ALLOW_FRAGMENT */ - { sizeof(ULONG), FALSE }, /* WS_XML_READER_PROPERTY_MAX_ATTRIBUTES */ + { sizeof(ULONG), FALSE }, /* WS_XML_WRITER_PROPERTY_MAX_ATTRIBUTES */ { sizeof(BOOL), FALSE }, /* WS_XML_WRITER_PROPERTY_WRITE_DECLARATION */ { sizeof(ULONG), FALSE }, /* WS_XML_WRITER_PROPERTY_INDENT */ { sizeof(ULONG), FALSE }, /* WS_XML_WRITER_PROPERTY_BUFFER_TRIM_SIZE */ @@ -85,6 +85,7 @@ struct writer WS_CHARSET output_charset; WS_XML_WRITER_OUTPUT_TYPE output_type; struct xmlbuf *output_buf; + BOOL output_buf_user; WS_HEAP *output_heap; const WS_XML_DICTIONARY *dict; BOOL dict_do_lookup; @@ -332,7 +333,7 @@ HRESULT WINAPI WsGetWriterProperty( WS_XML_WRITER *handle, WS_XML_WRITER_PROPERT static void set_output_buffer( struct writer *writer, struct xmlbuf *xmlbuf ) { /* free current buffer if it's ours */ - if (writer->output_buf && writer->output_buf->heap == writer->output_heap) + if (writer->output_buf && !writer->output_buf_user) { free_xmlbuf( writer->output_buf ); } @@ -419,6 +420,7 @@ HRESULT WINAPI WsSetOutput( WS_XML_WRITER *handle, const WS_XML_WRITER_ENCODING goto done; } set_output_buffer( writer, xmlbuf ); + writer->output_buf_user = FALSE; break; } default: @@ -472,6 +474,7 @@ HRESULT WINAPI WsSetOutputToBuffer( WS_XML_WRITER *handle, WS_XML_BUFFER *buffer writer->output_enc = xmlbuf->encoding; writer->output_charset = xmlbuf->charset; set_output_buffer( writer, xmlbuf ); + writer->output_buf_user = TRUE; if (!(node = alloc_node( WS_XML_NODE_TYPE_BOF ))) hr = E_OUTOFMEMORY; else write_insert_bof( writer, node );