ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

comctl32: Avoid use-after-free in DPA_Merge (DPH).

This commit is contained in:
Thomas Faber 2015-04-18 12:08:29 +02:00 committed by Alexandre Julliard
parent 7c85ed6aab
commit 13b65faf4e
1 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
dlls/comctl32/dpa.c
View File

@ -303,16 +303,14 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
hdpa1->nItemCount, hdpa2->nItemCount); hdpa1->nItemCount, hdpa2->nItemCount);
/* working but untrusted implementation */
pWork1 = &(hdpa1->ptrs[hdpa1->nItemCount - 1]);
pWork2 = &(hdpa2->ptrs[hdpa2->nItemCount - 1]);
nIndex = hdpa1->nItemCount - 1; nIndex = hdpa1->nItemCount - 1;
nCount = hdpa2->nItemCount - 1; nCount = hdpa2->nItemCount - 1;
do do
{ {
pWork1 = &hdpa1->ptrs[nIndex];
pWork2 = &hdpa2->ptrs[nCount];
if (nIndex < 0) { if (nIndex < 0) {
if ((nCount >= 0) && (dwFlags & DPAM_UNION)) { if ((nCount >= 0) && (dwFlags & DPAM_UNION)) {
/* Now insert the remaining new items into DPA 1 */ /* Now insert the remaining new items into DPA 1 */
@ -343,10 +341,8 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
return FALSE; return FALSE;
nCount--; nCount--;
pWork2--;
*pWork1 = ptr; *pWork1 = ptr;
nIndex--; nIndex--;
pWork1--;
} }
else if (nResult > 0) else if (nResult > 0)
{ {
@ -361,7 +357,6 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
(pfnMerge)(DPAMM_DELETE, ptr, NULL, lParam); (pfnMerge)(DPAMM_DELETE, ptr, NULL, lParam);
} }
nIndex--; nIndex--;
pWork1--;
} }
else else
{ {
@ -377,7 +372,6 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
DPA_InsertPtr (hdpa1, nIndex+1, ptr); DPA_InsertPtr (hdpa1, nIndex+1, ptr);
} }
nCount--; nCount--;
pWork2--;
} }
} }