ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

user32: Validate DIB offset in CURSORICON_GetFileEntry. 

Signed-off-by: Bernhard Übelacker <bernhardu@mailbox.org>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Bernhard Übelacker 2018-01-28 19:15:44 +01:00 committed by Alexandre Julliard
parent 318edcc94a
commit 9256017adf
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
dlls/user32/cursoricon.c
View File

@ -678,6 +678,7 @@ static BOOL CURSORICON_GetFileEntry( LPCVOID dir, DWORD size, int n,
if ((const char *)&filedir->idEntries[n + 1] - (const char *)dir > size)
return FALSE;
entry = &filedir->idEntries[n];
if (entry->dwDIBOffset > size - sizeof(info->biSize)) return FALSE;
info = (const BITMAPINFOHEADER *)((const char *)dir + entry->dwDIBOffset);
if (info->biSize != sizeof(BITMAPCOREHEADER))
{

8
dlls/user32/tests/cursoricon.c
View File

@ -1031,6 +1031,12 @@ static const unsigned char gif4pixel[42] = {
0x02,0x00,0x00,0x02,0x03,0x14,0x16,0x05,0x00,0x3b
};
/* An invalid cursor with an invalid dwDIBOffset */
static const unsigned char invalid_dwDIBOffset[] = {
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00
};
static const DWORD biSize_tests[] = {
0,
sizeof(BITMAPCOREHEADER) - 1,
@ -1320,6 +1326,8 @@ static void test_LoadImage(void)
test_LoadImageFile("BMP (broken biSize)", bmpimage, sizeof(bmpimage), "bmp", 0);
}
bitmap_header->biSize = sizeof(BITMAPINFOHEADER);
test_LoadImageFile("Cursor (invalid dwDIBOffset)", invalid_dwDIBOffset, sizeof(invalid_dwDIBOffset), "cur", 0);
}
#undef ARRAY_SIZE