ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mshtml: Avoid passing invalid memory to DispCallFunc(). 

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47222
Signed-off-by: Zebediah Figura <z.figura12@gmail.com>
Signed-off-by: Jacek Caban <jacek@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Zebediah Figura 2019-05-20 10:33:25 -05:00 committed by Alexandre Julliard
parent f8fffe9e86
commit 23e0d22b7c
1 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
dlls/mshtml/dispex.c
View File

@ -295,22 +295,28 @@ static void add_func_info(dispex_data_t *data, tid_t tid, const FUNCDESC *desc,
assert(info->argc < MAX_ARGS);
assert(desc->funckind == FUNC_DISPATCH);
info->arg_types = heap_alloc(sizeof(*info->arg_types) * info->argc);
if(!info->arg_types)
return;
info->arg_info = heap_alloc_zero(sizeof(*info->arg_info) * info->argc);
if(!info->arg_info)
return;
for(i=0; i < info->argc; i++)
info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
info->prop_vt = desc->elemdescFunc.tdesc.vt;
if(info->prop_vt != VT_VOID && info->prop_vt != VT_PTR && !is_arg_type_supported(info->prop_vt)) {
TRACE("%s: return type %d\n", debugstr_w(info->name), info->prop_vt);
return; /* Fallback to ITypeInfo::Invoke */
}
info->arg_types = heap_alloc(sizeof(*info->arg_types) * (info->argc + (info->prop_vt == VT_VOID ? 0 : 1)));
if(!info->arg_types)
return;
for(i=0; i < info->argc; i++)
info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
if(info->prop_vt == VT_PTR)
info->arg_types[info->argc] = VT_BYREF | VT_DISPATCH;
else if(info->prop_vt != VT_VOID)
info->arg_types[info->argc] = VT_BYREF | info->prop_vt;
if(desc->cParamsOpt) {
TRACE("%s: optional params\n", debugstr_w(info->name));
return; /* Fallback to ITypeInfo::Invoke */