Fixed potential buffer overflows (spotted by Francois Gouget).
This commit is contained in:
parent
6f715732e7
commit
f1f68312e7
25
misc/ddeml.c
25
misc/ddeml.c
|
@ -445,16 +445,16 @@ void FindNotifyMonitorCallbacks(DWORD ThisInstance, DWORD DdeEvent )
|
|||
*
|
||||
*/
|
||||
|
||||
void DdeReserveAtom( DDE_HANDLE_ENTRY * reference_inst,HSZ hsz)
|
||||
static void DdeReserveAtom( DDE_HANDLE_ENTRY * reference_inst,HSZ hsz)
|
||||
{
|
||||
CHAR SNameBuffer[MAX_BUFFER_LEN];
|
||||
UINT rcode;
|
||||
if ( reference_inst->Unicode)
|
||||
{
|
||||
rcode=GlobalGetAtomNameW(hsz,(LPWSTR)&SNameBuffer,MAX_ATOM_LEN);
|
||||
GlobalAddAtomW((LPWSTR)SNameBuffer);
|
||||
WCHAR SNameBuffer[MAX_BUFFER_LEN];
|
||||
GlobalGetAtomNameW(hsz,SNameBuffer,MAX_BUFFER_LEN);
|
||||
GlobalAddAtomW(SNameBuffer);
|
||||
} else {
|
||||
rcode=GlobalGetAtomNameA(hsz,SNameBuffer,MAX_ATOM_LEN);
|
||||
CHAR SNameBuffer[MAX_BUFFER_LEN];
|
||||
GlobalGetAtomNameA(hsz,SNameBuffer,MAX_BUFFER_LEN);
|
||||
GlobalAddAtomA(SNameBuffer);
|
||||
}
|
||||
}
|
||||
|
@ -475,18 +475,9 @@ void DdeReserveAtom( DDE_HANDLE_ENTRY * reference_inst,HSZ hsz)
|
|||
*
|
||||
*/
|
||||
|
||||
void DdeReleaseAtom( DDE_HANDLE_ENTRY * reference_inst,HSZ hsz)
|
||||
static void DdeReleaseAtom( DDE_HANDLE_ENTRY * reference_inst,HSZ hsz)
|
||||
{
|
||||
CHAR SNameBuffer[MAX_BUFFER_LEN];
|
||||
UINT rcode;
|
||||
if ( reference_inst->Unicode)
|
||||
{
|
||||
rcode=GlobalGetAtomNameW(hsz,(LPWSTR)&SNameBuffer,MAX_ATOM_LEN);
|
||||
GlobalAddAtomW((LPWSTR)SNameBuffer);
|
||||
} else {
|
||||
rcode=GlobalGetAtomNameA(hsz,SNameBuffer,MAX_ATOM_LEN);
|
||||
GlobalAddAtomA(SNameBuffer);
|
||||
}
|
||||
GlobalDeleteAtom( hsz );
|
||||
}
|
||||
|
||||
/******************************************************************************
|
||||
|
|
|
@ -663,7 +663,6 @@ static HWND WIN_CreateWindowEx( CREATESTRUCTA *cs, ATOM classAtom,
|
|||
HWND16 hwnd, hwndLinkAfter;
|
||||
POINT maxSize, maxPos, minTrack, maxTrack;
|
||||
LRESULT (CALLBACK *localSend32)(HWND, UINT, WPARAM, LPARAM);
|
||||
char buffer[256];
|
||||
|
||||
TRACE("%s %s %08lx %08lx %d,%d %dx%d %04x %04x %08x %p\n",
|
||||
unicode ? debugres_w((LPWSTR)cs->lpszName) : debugres_a(cs->lpszName),
|
||||
|
@ -689,24 +688,12 @@ static HWND WIN_CreateWindowEx( CREATESTRUCTA *cs, ATOM classAtom,
|
|||
/* Find the window class */
|
||||
if (!(classPtr = CLASS_FindClassByAtom( classAtom, win32?cs->hInstance:GetExePtr(cs->hInstance) )))
|
||||
{
|
||||
char buffer[256];
|
||||
GlobalGetAtomNameA( classAtom, buffer, sizeof(buffer) );
|
||||
WARN("Bad class '%s'\n", buffer );
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Fix the lpszClass field: from existing programs, it seems ok to call a CreateWindowXXX
|
||||
* with an atom as the class name, put some programs expect to have a *REAL* string in
|
||||
* lpszClass when the CREATESTRUCT is sent with WM_CREATE
|
||||
*/
|
||||
if ( !HIWORD(cs->lpszClass) ) {
|
||||
if (unicode) {
|
||||
GlobalGetAtomNameW( classAtom, (LPWSTR)buffer, sizeof(buffer) );
|
||||
} else {
|
||||
GlobalGetAtomNameA( classAtom, buffer, sizeof(buffer) );
|
||||
}
|
||||
cs->lpszClass = buffer;
|
||||
}
|
||||
|
||||
/* Fix the coordinates */
|
||||
|
||||
if (cs->x == CW_USEDEFAULT || cs->x == CW_USEDEFAULT16)
|
||||
|
@ -1047,6 +1034,7 @@ HWND16 WINAPI CreateWindowEx16( DWORD exStyle, LPCSTR className,
|
|||
{
|
||||
ATOM classAtom;
|
||||
CREATESTRUCTA cs;
|
||||
char buffer[256];
|
||||
|
||||
/* Find the class atom */
|
||||
|
||||
|
@ -1075,6 +1063,13 @@ HWND16 WINAPI CreateWindowEx16( DWORD exStyle, LPCSTR className,
|
|||
cs.lpszName = windowName;
|
||||
cs.lpszClass = className;
|
||||
cs.dwExStyle = exStyle;
|
||||
|
||||
/* make sure lpszClass is a string */
|
||||
if (!HIWORD(cs.lpszClass))
|
||||
{
|
||||
GlobalGetAtomNameA( classAtom, buffer, sizeof(buffer) );
|
||||
cs.lpszClass = buffer;
|
||||
}
|
||||
return WIN_CreateWindowEx( &cs, classAtom, FALSE, FALSE );
|
||||
}
|
||||
|
||||
|
@ -1090,6 +1085,7 @@ HWND WINAPI CreateWindowExA( DWORD exStyle, LPCSTR className,
|
|||
{
|
||||
ATOM classAtom;
|
||||
CREATESTRUCTA cs;
|
||||
char buffer[256];
|
||||
|
||||
if(!instance)
|
||||
instance=GetModuleHandleA(NULL);
|
||||
|
@ -1120,6 +1116,13 @@ HWND WINAPI CreateWindowExA( DWORD exStyle, LPCSTR className,
|
|||
cs.lpszName = windowName;
|
||||
cs.lpszClass = className;
|
||||
cs.dwExStyle = exStyle;
|
||||
|
||||
/* make sure lpszClass is a string */
|
||||
if (!HIWORD(cs.lpszClass))
|
||||
{
|
||||
GlobalGetAtomNameA( classAtom, buffer, sizeof(buffer) );
|
||||
cs.lpszClass = buffer;
|
||||
}
|
||||
return WIN_CreateWindowEx( &cs, classAtom, TRUE, FALSE );
|
||||
}
|
||||
|
||||
|
@ -1135,6 +1138,7 @@ HWND WINAPI CreateWindowExW( DWORD exStyle, LPCWSTR className,
|
|||
{
|
||||
ATOM classAtom;
|
||||
CREATESTRUCTW cs;
|
||||
WCHAR buffer[256];
|
||||
|
||||
if(!instance)
|
||||
instance=GetModuleHandleA(NULL);
|
||||
|
@ -1171,6 +1175,14 @@ HWND WINAPI CreateWindowExW( DWORD exStyle, LPCWSTR className,
|
|||
cs.lpszName = windowName;
|
||||
cs.lpszClass = className;
|
||||
cs.dwExStyle = exStyle;
|
||||
|
||||
/* make sure lpszClass is a string */
|
||||
if (!HIWORD(cs.lpszClass))
|
||||
{
|
||||
GlobalGetAtomNameW( classAtom, buffer, sizeof(buffer)/sizeof(WCHAR) );
|
||||
cs.lpszClass = buffer;
|
||||
}
|
||||
|
||||
/* Note: we rely on the fact that CREATESTRUCT32A and */
|
||||
/* CREATESTRUCT32W have the same layout. */
|
||||
return WIN_CreateWindowEx( (CREATESTRUCTA *)&cs, classAtom, TRUE, TRUE );
|
||||
|
|
Loading…
Reference in New Issue