ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

comctl32/dpa: Fix parameter validation in DPA_LoadStream().

This commit is contained in:
Nikolay Sivov 2009-09-12 03:32:02 +04:00 committed by Alexandre Julliard
parent b07ca01527
commit c8f8e5da11
2 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
dlls/comctl32/dpa.c
View File

@ -84,7 +84,7 @@ HRESULT WINAPI DPA_LoadStream (HDPA *phDpa, PFNDPASTREAM loadProc,
{ {
HRESULT errCode; HRESULT errCode;
LARGE_INTEGER position; LARGE_INTEGER position;
ULARGE_INTEGER newPosition; ULARGE_INTEGER initial_pos;
STREAMDATA streamData; STREAMDATA streamData;
DPASTREAMINFO streamInfo; DPASTREAMINFO streamInfo;
ULONG ulRead; ULONG ulRead;
@ -101,15 +101,11 @@ HRESULT WINAPI DPA_LoadStream (HDPA *phDpa, PFNDPASTREAM loadProc,
position.QuadPart = 0; position.QuadPart = 0;
/* errCode = IStream_Seek (pStream, position, STREAM_SEEK_CUR, &initial_pos);
* Zero out our streamData
*/
memset(&streamData,0,sizeof(STREAMDATA));
errCode = IStream_Seek (pStream, position, STREAM_SEEK_CUR, &newPosition);
if (errCode != S_OK) if (errCode != S_OK)
return errCode; return errCode;
memset(&streamData, 0, sizeof(STREAMDATA));
errCode = IStream_Read (pStream, &streamData, sizeof(STREAMDATA), &ulRead); errCode = IStream_Read (pStream, &streamData, sizeof(STREAMDATA), &ulRead);
if (errCode != S_OK) if (errCode != S_OK)
return errCode; return errCode;
@ -117,11 +113,12 @@ HRESULT WINAPI DPA_LoadStream (HDPA *phDpa, PFNDPASTREAM loadProc,
FIXME ("dwSize=%u dwData2=%u dwItems=%u\n", FIXME ("dwSize=%u dwData2=%u dwItems=%u\n",
streamData.dwSize, streamData.dwData2, streamData.dwItems); streamData.dwSize, streamData.dwData2, streamData.dwItems);
if ( ulRead < sizeof(STREAMDATA) || if (ulRead < sizeof(STREAMDATA) ||
(DWORD)pData < sizeof(STREAMDATA) || streamData.dwSize < sizeof(STREAMDATA) || streamData.dwData2 != 1) {
streamData.dwSize < sizeof(STREAMDATA) || /* back to initial position */
streamData.dwData2 < 1) { position.QuadPart = initial_pos.QuadPart;
errCode = E_FAIL; IStream_Seek (pStream, position, STREAM_SEEK_SET, NULL);
return E_FAIL;
} }
if (streamData.dwItems > (UINT_MAX / 2 / sizeof(VOID*))) /* 536870911 */ if (streamData.dwItems > (UINT_MAX / 2 / sizeof(VOID*))) /* 536870911 */

6
dlls/comctl32/tests/dpa.c
View File

@ -586,7 +586,7 @@ static void test_DPA_LoadStream(void)
uli.QuadPart = 1; uli.QuadPart = 1;
hRes = IStream_Seek(pStm, li, STREAM_SEEK_CUR, &uli); hRes = IStream_Seek(pStm, li, STREAM_SEEK_CUR, &uli);
expect(S_OK, hRes); expect(S_OK, hRes);
todo_wine ok(uli.QuadPart == 0, "Expected to position reset\n"); ok(uli.QuadPart == 0, "Expected to position reset\n");
/* write valid header for empty DPA */ /* write valid header for empty DPA */
header.dwSize = sizeof(header); header.dwSize = sizeof(header);
@ -612,7 +612,7 @@ static void test_DPA_LoadStream(void)
expect(S_OK, hRes); expect(S_OK, hRes);
hRes = pDPA_LoadStream(&dpa, CB_Load, pStm, NULL); hRes = pDPA_LoadStream(&dpa, CB_Load, pStm, NULL);
todo_wine expect(S_OK, hRes); expect(S_OK, hRes);
/* try with altered dwData2 field */ /* try with altered dwData2 field */
header.dwSize = sizeof(header); header.dwSize = sizeof(header);
@ -632,7 +632,7 @@ static void test_DPA_LoadStream(void)
expect(S_OK, hRes); expect(S_OK, hRes);
hRes = pDPA_LoadStream(&dpa, CB_Load, pStm, (void*)0xdeadbeef); hRes = pDPA_LoadStream(&dpa, CB_Load, pStm, (void*)0xdeadbeef);
todo_wine expect(E_FAIL, hRes); expect(E_FAIL, hRes);
ret = IStream_Release(pStm); ret = IStream_Release(pStm);
ok(!ret, "ret=%d\n", ret); ok(!ret, "ret=%d\n", ret);