ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

kernel32: Validate handle before freeing a LOAD_LIBRARY_AS_DATAFILE module. 

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=46019
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Alexandre Julliard 2019-04-05 09:42:09 +02:00
parent f2deab4174
commit 35d202fc09
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dlls/kernel32/module.c
View File

@ -1102,6 +1102,12 @@ BOOL WINAPI DECLSPEC_HOTPATCH FreeLibrary(HINSTANCE hLibModule)
if ((ULONG_PTR)hLibModule & 3) /* this is a datafile module */ if ((ULONG_PTR)hLibModule & 3) /* this is a datafile module */
{ {
void *ptr = (void *)((ULONG_PTR)hLibModule & ~3);
if (!RtlImageNtHeader( ptr ))
{
SetLastError( ERROR_BAD_EXE_FORMAT );
return FALSE;
}
if ((ULONG_PTR)hLibModule & 1) if ((ULONG_PTR)hLibModule & 1)
{ {
struct exclusive_datafile *file; struct exclusive_datafile *file;
@ -1119,7 +1125,7 @@ BOOL WINAPI DECLSPEC_HOTPATCH FreeLibrary(HINSTANCE hLibModule)
} }
LdrUnlockLoaderLock( 0, magic ); LdrUnlockLoaderLock( 0, magic );
} }
return UnmapViewOfFile( (void *)((ULONG_PTR)hLibModule & ~3) ); return UnmapViewOfFile( ptr );
} }
if ((nts = LdrUnloadDll( hLibModule )) == STATUS_SUCCESS) retv = TRUE; if ((nts = LdrUnloadDll( hLibModule )) == STATUS_SUCCESS) retv = TRUE;

5
dlls/kernel32/tests/module.c
View File

@ -429,6 +429,11 @@ static void testLoadLibraryEx(void)
hmodule = LoadLibraryExA("comctl32.dll", NULL, LOAD_LIBRARY_AS_DATAFILE); hmodule = LoadLibraryExA("comctl32.dll", NULL, LOAD_LIBRARY_AS_DATAFILE);
ok(hmodule != 0, "Expected valid module handle\n"); ok(hmodule != 0, "Expected valid module handle\n");
SetLastError(0xdeadbeef);
ret = FreeLibrary( (HMODULE)((ULONG_PTR)hmodule + 0x1230));
ok(!ret, "Free succeeded on wrong handle\n");
ok(GetLastError() == ERROR_BAD_EXE_FORMAT, "wrong error %u\n", GetLastError());
SetLastError(0xdeadbeef); SetLastError(0xdeadbeef);
ret = FreeLibrary(hmodule); ret = FreeLibrary(hmodule);
ok(ret, "Expected to be able to free the module, failed with %d\n", GetLastError()); ok(ret, "Expected to be able to free the module, failed with %d\n", GetLastError());