IE9 Compatibility–HttpOpenRequest and lplpszAcceptTypes

The WinINET API allows the caller to specify the accepted MIME types for a given HTTP request by passing a null-terminated array of null-terminated strings using the lplpszAcceptTypes parameter. When calling the HttpOpenRequest API, applications must take care to either pass NULL, or a pointer to a properly-formed array of MIME-type strings.

// Null-terminated array of null-terminated strings
const char* lplpszAcceptTypes[] = {"text/xml", "application/xml", NULL};

HINTERNET  hHttpFile = HttpOpenRequestA(hConnect, "GET", "/test.xml", NULL, NULL, lplpszAcceptTypes, 0, NULL);

Unfortunately, this isn’t a common parameter-passing convention, and it turns out that many applications, including a popular car racing game and VoIP software, incorrectly call the API with a pointer to a plain string.

Prior to IE9 beta, WinINET would process the array using APIs that are now banned by the Security Development Lifecycle. The result is that, rather than crashing, the error might have gone unnoticed when earlier versions of IE were installed. Now that the version of WinINET installed with Internet Explorer 9 uses string-handling code that does not result in accommodating illegal input, the applications will crash when they attempt to make HTTP requests.

The IE Team is working on outreach to vendors of affected applications.


Comments (2)
  1. EricLaw [MSFT] says:

    Here's a similar post from a few years back, the last time that WinINET removed some banned APIs:

  2. Update: IE9 RTW introduced a mitigation to attempt to detect the bad calling pattern. If detected, then the application will not crash, but the ACCEPT header will not be sent.

Comments are closed.

Skip to main content