ReceiveTempSMS
/
Sweden-Number
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

shell32: Adding a systray item with an invalid icon handle is allowed.

This commit is contained in:
Robert Shearman 2006-03-27 16:55:37 +01:00 committed by Alexandre Julliard
parent d6ce9db80f
commit e8fe7004c7
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
dlls/shell32/systray.c
View File

@ -99,21 +99,26 @@ BOOL WINAPI Shell_NotifyIconW(DWORD dwMessage, PNOTIFYICONDATAW nid)
LONG cbColourBits;
if (!GetIconInfo(nid->hIcon, &iconinfo))
return FALSE;
goto noicon;
if (!GetObjectW(iconinfo.hbmMask, sizeof(bmMask), &bmMask) ||
!GetObjectW(iconinfo.hbmColor, sizeof(bmColour), &bmColour))
{
DeleteObject(iconinfo.hbmMask);
DeleteObject(iconinfo.hbmColor);
return FALSE;
goto noicon;
}
cbMaskBits = (bmMask.bmPlanes * bmMask.bmWidth * bmMask.bmHeight * bmMask.bmBitsPixel) / 8;
cbColourBits = (bmColour.bmPlanes * bmColour.bmWidth * bmColour.bmHeight * bmColour.bmBitsPixel) / 8;
cds.cbData = sizeof(*nid) + 2*sizeof(BITMAP) + cbMaskBits + cbColourBits;
buffer = HeapAlloc(GetProcessHeap(), 0, cds.cbData);
if (!buffer) return FALSE;
if (!buffer)
{
DeleteObject(iconinfo.hbmMask);
DeleteObject(iconinfo.hbmColor);
return FALSE;
}
cds.lpData = buffer;
memcpy(buffer, nid, sizeof(*nid));
@ -132,6 +137,7 @@ BOOL WINAPI Shell_NotifyIconW(DWORD dwMessage, PNOTIFYICONDATAW nid)
}
else
{
noicon:
cds.cbData = sizeof(*nid);
cds.lpData = nid;
}

8
programs/explorer/systray.c
View File

@ -259,7 +259,7 @@ static void handle_incoming(HWND hwndSource, COPYDATASTRUCT *cds)
/* FIXME: if statement only needed because we don't support interprocess
* icon handles */
if (nid.uFlags & NIF_ICON)
if ((nid.uFlags & NIF_ICON) && (cds->cbData >= sizeof(nid) + 2 * sizeof(BITMAP)))
{
LONG cbMaskBits;
LONG cbColourBits;
@ -269,12 +269,6 @@ static void handle_incoming(HWND hwndSource, COPYDATASTRUCT *cds)
buffer += sizeof(nid);
if (cds->cbData < sizeof(nid) + 2 * sizeof(BITMAP))
{
WINE_ERR("buffer underflow\n");
return;
}
memcpy(&bmMask, buffer, sizeof(bmMask));
buffer += sizeof(bmMask);
memcpy(&bmColour, buffer, sizeof(bmColour));