diff --git a/reactos/dll/win32/hhctrl.ocx/chm.c b/reactos/dll/win32/hhctrl.ocx/chm.c
index e8d036b67bf..b7df8e72c7d 100644
--- a/reactos/dll/win32/hhctrl.ocx/chm.c
+++ b/reactos/dll/win32/hhctrl.ocx/chm.c
@@ -362,15 +362,18 @@ IStream *GetChmStream(CHMInfo *info, LPCWSTR parent_chm, ChmPath *chm_file)
/* Opens the CHM file for reading */
CHMInfo *OpenCHM(LPCWSTR szFile)
{
- WCHAR file[MAX_PATH] = {0};
HRESULT hres;
+ CHMInfo *ret;
static const WCHAR wszSTRINGS[] = {'#','S','T','R','I','N','G','S',0};
- CHMInfo *ret = heap_alloc_zero(sizeof(CHMInfo));
+ if (!(ret = heap_alloc_zero(sizeof(CHMInfo))))
+ return NULL;
- GetFullPathNameW(szFile, sizeof(file)/sizeof(file[0]), file, NULL);
- ret->szFile = strdupW(file);
+ if (!(ret->szFile = strdupW(szFile))) {
+ heap_free(ret);
+ return NULL;
+ }
hres = CoCreateInstance(&CLSID_ITStorage, NULL, CLSCTX_INPROC_SERVER,
&IID_IITStorage, (void **) &ret->pITStorage) ;
@@ -423,6 +426,7 @@ CHMInfo *CloseCHM(CHMInfo *chm)
heap_free(chm->defTitle);
heap_free(chm->defTopic);
heap_free(chm->defToc);
+ heap_free(chm->szFile);
heap_free(chm);
return NULL;
diff --git a/reactos/dll/win32/hhctrl.ocx/help.c b/reactos/dll/win32/hhctrl.ocx/help.c
index ff703384e67..092e97e8784 100644
--- a/reactos/dll/win32/hhctrl.ocx/help.c
+++ b/reactos/dll/win32/hhctrl.ocx/help.c
@@ -115,7 +115,9 @@ BOOL NavigateToChm(HHInfo *info, LPCWSTR file, LPCWSTR index)
LPWSTR ptr;
static const WCHAR url_format[] =
- {'m','k',':','@','M','S','I','T','S','t','o','r','e',':','%','s',':',':','%','s',0};
+ {'m','k',':','@','M','S','I','T','S','t','o','r','e',':','%','s',':',':','%','s','%','s',0};
+ static const WCHAR slash[] = {'/',0};
+ static const WCHAR empty[] = {0};
TRACE("%p %s %s\n", info, debugstr_w(file), debugstr_w(index));
@@ -127,7 +129,7 @@ BOOL NavigateToChm(HHInfo *info, LPCWSTR file, LPCWSTR index)
return FALSE;
}
- wsprintfW(buf, url_format, full_path, index);
+ wsprintfW(buf, url_format, full_path, (!index || index[0] == '/') ? empty : slash, index);
/* FIXME: HACK */
if((ptr = strchrW(buf, '#')))
diff --git a/reactos/dll/win32/hhctrl.ocx/hhctrl.c b/reactos/dll/win32/hhctrl.ocx/hhctrl.c
index 5e707b92560..8268a21f34b 100644
--- a/reactos/dll/win32/hhctrl.ocx/hhctrl.c
+++ b/reactos/dll/win32/hhctrl.ocx/hhctrl.c
@@ -86,11 +86,27 @@ static const char *command_to_string(UINT command)
#undef X
}
+static BOOL resolve_filename(const WCHAR *filename, WCHAR *fullname, DWORD buflen)
+{
+ static const WCHAR helpW[] = {'\\','h','e','l','p','\\',0};
+
+ GetFullPathNameW(filename, buflen, fullname, NULL);
+ if (GetFileAttributesW(fullname) == INVALID_FILE_ATTRIBUTES)
+ {
+ GetWindowsDirectoryW(fullname, buflen);
+ strcatW(fullname, helpW);
+ strcatW(fullname, filename);
+ }
+ return (GetFileAttributesW(fullname) != INVALID_FILE_ATTRIBUTES);
+}
+
/******************************************************************
* HtmlHelpW (HHCTRL.OCX.15)
*/
HWND WINAPI HtmlHelpW(HWND caller, LPCWSTR filename, UINT command, DWORD_PTR data)
{
+ WCHAR fullname[MAX_PATH];
+
TRACE("(%p, %s, command=%s, data=%lx)\n",
caller, debugstr_w( filename ),
command_to_string( command ), data);
@@ -119,13 +135,14 @@ HWND WINAPI HtmlHelpW(HWND caller, LPCWSTR filename, UINT command, DWORD_PTR dat
filename = chm_file;
index += 2; /* advance beyond "::" for calling NavigateToChm() later */
}
- else
+
+ if (!resolve_filename(filename, fullname, MAX_PATH))
{
- if (command!=HH_DISPLAY_SEARCH) /* FIXME - use HH_FTS_QUERYW structure in data */
- index = (const WCHAR*)data;
+ WARN("can't find %s\n", debugstr_w(filename));
+ return 0;
}
- info = CreateHelpViewer(filename);
+ info = CreateHelpViewer(fullname);
if(!info)
return NULL;
@@ -147,7 +164,13 @@ HWND WINAPI HtmlHelpW(HWND caller, LPCWSTR filename, UINT command, DWORD_PTR dat
if (!filename)
return NULL;
- info = CreateHelpViewer(filename);
+ if (!resolve_filename(filename, fullname, MAX_PATH))
+ {
+ WARN("can't find %s\n", debugstr_w(filename));
+ return 0;
+ }
+
+ info = CreateHelpViewer(fullname);
if(!info)
return NULL;
diff --git a/reactos/dll/win32/hhctrl.ocx/hhctrl.ocx_ros.diff b/reactos/dll/win32/hhctrl.ocx/hhctrl.ocx_ros.diff
deleted file mode 100644
index 73495b417af..00000000000
--- a/reactos/dll/win32/hhctrl.ocx/hhctrl.ocx_ros.diff
+++ /dev/null
@@ -1,16 +0,0 @@
-Index: hhctrl.ocx.rbuild
-===================================================================
---- hhctrl.ocx.rbuild (revision 32840)
-+++ hhctrl.ocx.rbuild (working copy)
-@@ -6,9 +6,11 @@
-
- .
- include/reactos/wine
-+ include/reactos
-
- 0x600
- 0x600
-+ wineheaders
- chm.c
- content.c
- help.c
diff --git a/reactos/dll/win32/hhctrl.ocx/resource.h b/reactos/dll/win32/hhctrl.ocx/resource.h
index 02df94641e9..a08fdd96eb8 100644
--- a/reactos/dll/win32/hhctrl.ocx/resource.h
+++ b/reactos/dll/win32/hhctrl.ocx/resource.h
@@ -18,6 +18,11 @@
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
*/
+#include
+#include
+#include
+#include
+
#define IDS_CONTENTS 1
#define IDS_INDEX 2
#define IDS_SEARCH 3
diff --git a/reactos/dll/win32/winemp3.acm/layer3.c b/reactos/dll/win32/winemp3.acm/layer3.c
index c655dcd7aba..17f5a7a9972 100644
--- a/reactos/dll/win32/winemp3.acm/layer3.c
+++ b/reactos/dll/win32/winemp3.acm/layer3.c
@@ -1061,8 +1061,9 @@ maybe still wrong??? (copy 12 to 13?) */
* and mode = mixed_mode
*/
int sfb = gr_info->maxbandl;
- int idx = bi->longIdx[sfb];
-
+ int idx;
+ if(sfb > 21) return; /* similarity fix related to CVE-2006-1655 */
+ idx = bi->longIdx[sfb];
for ( ; sfb<8; sfb++ )
{
int sb = bi->longDiff[sfb];
@@ -1085,7 +1086,9 @@ maybe still wrong??? (copy 12 to 13?) */
else /* ((gr_info->block_type != 2)) */
{
int sfb = gr_info->maxbandl;
- int is_p,idx = bi->longIdx[sfb];
+ int is_p,idx;
+ if (sfb > 21) return; /* tightened fix for CVE-2006-1655 */
+ idx = bi->longIdx[sfb];
for ( ; sfb<21; sfb++)
{
int sb = bi->longDiff[sfb];