March 2014 - Wine-commits - list.winehq.org

Nikolay Sivov : winhttp: Move allocation after input validation to fix leaks (Coverity).
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: e3a94656f2394c0ac0ec2a3be996a083ce124204 URL: http://source.winehq.org/git/wine.git/?a=commit;h=e3a94656f2394c0ac0ec2a3be… Author: Nikolay Sivov <nsivov(a)codeweavers.com> Date: Tue Mar 25 08:04:45 2014 +0400 winhttp: Move allocation after input validation to fix leaks (Coverity). --- dlls/winhttp/cookie.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dlls/winhttp/cookie.c b/dlls/winhttp/cookie.c index af881ea..6e104b2 100644 --- a/dlls/winhttp/cookie.c +++ b/dlls/winhttp/cookie.c @@ -134,10 +134,6 @@ static cookie_t *parse_cookie( const WCHAR *string ) const WCHAR *p; int len; - if (!(cookie = heap_alloc_zero( sizeof(cookie_t) ))) return NULL; - - list_init( &cookie->entry ); - if (!(p = strchrW( string, '=' ))) { WARN("no '=' in %s\n", debugstr_w(string)); @@ -148,6 +144,11 @@ static cookie_t *parse_cookie( const WCHAR *string ) WARN("empty cookie name in %s\n", debugstr_w(string)); return NULL; } + + if (!(cookie = heap_alloc_zero( sizeof(cookie_t) ))) return NULL; + + list_init( &cookie->entry ); + len = p - string; if (!(cookie->name = heap_alloc( (len + 1) * sizeof(WCHAR) ))) {

1 0

Piotr Caban : user32/tests: Workaround SetForegroundWindow failure due to foreground lock timeout.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: 61a92af5cab3714ab747c3bb14fd0f0d917eca8e URL: http://source.winehq.org/git/wine.git/?a=commit;h=61a92af5cab3714ab747c3bb1… Author: Piotr Caban <piotr(a)codeweavers.com> Date: Mon Mar 24 19:31:21 2014 +0100 user32/tests: Workaround SetForegroundWindow failure due to foreground lock timeout. --- dlls/user32/tests/win.c | 41 +++++++++++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 12 deletions(-) diff --git a/dlls/user32/tests/win.c b/dlls/user32/tests/win.c index 69f3270..f8c919a 100644 --- a/dlls/user32/tests/win.c +++ b/dlls/user32/tests/win.c @@ -3728,13 +3728,10 @@ todo_wine check_active_state(parent, 0, parent); bret = SetForegroundWindow(popup); -todo_wine { - ok(bret || broken(!bret), "SetForegroundWindow() failed\n"); - if (!bret) - check_active_state(popup, 0, popup); - else +todo_wine + ok(bret, "SetForegroundWindow() failed\n"); + if (bret) check_active_state(popup, popup, popup); - } ok(DestroyWindow(parent), "DestroyWindow() failed\n"); @@ -7507,6 +7504,32 @@ START_TEST(win) if (!RegisterWindowClasses()) assert(0); + hwndMain = CreateWindowExA(/*WS_EX_TOOLWINDOW*/ 0, "MainWindowClass", "Main window", + WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX | + WS_MAXIMIZEBOX | WS_POPUP | WS_VISIBLE, + 100, 100, 200, 200, + 0, 0, GetModuleHandleA(NULL), NULL); + assert( hwndMain ); + + if(!SetForegroundWindow(hwndMain)) { + /* workaround for foreground lock timeout */ + INPUT input[2]; + UINT events_no; + + memset(input, 0, sizeof(input)); + input[0].type = INPUT_MOUSE; + input[0].mi.dx = 101; + input[0].mi.dy = 101; + input[0].mi.dwFlags = MOUSEEVENTF_LEFTDOWN; + input[0].type = INPUT_MOUSE; + input[0].mi.dx = 101; + input[0].mi.dy = 101; + input[0].mi.dwFlags = MOUSEEVENTF_LEFTUP; + events_no = SendInput(2, input, sizeof(input[0])); + ok(events_no == 2, "SendInput returned %d\n", events_no); + ok(SetForegroundWindow(hwndMain), "SetForegroundWindow failed\n"); + } + SetLastError(0xdeafbeef); GetWindowLongPtrW(GetDesktopWindow(), GWLP_WNDPROC); is_win9x = (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED); @@ -7518,17 +7541,11 @@ START_TEST(win) test_FindWindowEx(); test_SetParent(); - hwndMain = CreateWindowExA(/*WS_EX_TOOLWINDOW*/ 0, "MainWindowClass", "Main window", - WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX | - WS_MAXIMIZEBOX | WS_POPUP, - 100, 100, 200, 200, - 0, 0, GetModuleHandleA(NULL), NULL); hwndMain2 = CreateWindowExA(/*WS_EX_TOOLWINDOW*/ 0, "MainWindowClass", "Main window 2", WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP, 100, 100, 200, 200, 0, 0, GetModuleHandleA(NULL), NULL); - assert( hwndMain ); assert( hwndMain2 ); our_pid = GetWindowThreadProcessId(hwndMain, NULL);

1 0

Nikolay Sivov : comctl32: Fix a leak on error path (Coverity).
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: d60910fc149d49639b4e8d077f0bb1099cf8016f URL: http://source.winehq.org/git/wine.git/?a=commit;h=d60910fc149d49639b4e8d077… Author: Nikolay Sivov <nsivov(a)codeweavers.com> Date: Mon Mar 24 21:35:02 2014 +0400 comctl32: Fix a leak on error path (Coverity). --- dlls/comctl32/dpa.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dlls/comctl32/dpa.c b/dlls/comctl32/dpa.c index 41fb799..148d3f1 100644 --- a/dlls/comctl32/dpa.c +++ b/dlls/comctl32/dpa.c @@ -129,8 +129,10 @@ HRESULT WINAPI DPA_LoadStream (HDPA *phDpa, PFNDPASTREAM loadProc, if (!hDpa) return E_OUTOFMEMORY; - if (!DPA_Grow (hDpa, streamData.dwItems)) + if (!DPA_Grow (hDpa, streamData.dwItems)) { + DPA_Destroy (hDpa); return E_OUTOFMEMORY; + } /* load data from the stream into the dpa */ ptr = hDpa->ptrs;

1 0

Thomas Faber : dplayx: Fix broken pointer arithmetic.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: 4b1fb32d9dba1eee5e4ac09bd5a97541a32ff652 URL: http://source.winehq.org/git/wine.git/?a=commit;h=4b1fb32d9dba1eee5e4ac09bd… Author: Thomas Faber <thomas.faber(a)reactos.org> Date: Tue Mar 25 11:11:25 2014 +0100 dplayx: Fix broken pointer arithmetic. --- dlls/dplayx/dplayx_global.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dlls/dplayx/dplayx_global.c b/dlls/dplayx/dplayx_global.c index 55a7386..f68cad0 100644 --- a/dlls/dplayx/dplayx_global.c +++ b/dlls/dplayx/dplayx_global.c @@ -84,8 +84,9 @@ static LPVOID lpSharedStaticData = NULL; typedef struct { BOOL used; - DWORD data[dwBlockSize-sizeof(DWORD)]; + BYTE data[dwBlockSize - sizeof(BOOL)]; } DPLAYX_MEM_SLICE; +C_ASSERT(sizeof(DPLAYX_MEM_SLICE) == dwBlockSize); static DPLAYX_MEM_SLICE* lpMemArea; @@ -100,7 +101,7 @@ static void DPLAYX_PrivHeapFree( LPVOID addr ) return; } - lpAddrStart = (char*)addr - sizeof(DWORD); /* Find block header */ + lpAddrStart = CONTAINING_RECORD(addr, DPLAYX_MEM_SLICE, data); /* Find block header */ dwBlockUsed = ((BYTE*)lpAddrStart - (BYTE*)lpMemArea)/dwBlockSize; lpMemArea[ dwBlockUsed ].used = FALSE; @@ -111,10 +112,10 @@ static LPVOID DPLAYX_PrivHeapAlloc( DWORD flags, DWORD size ) LPVOID lpvArea = NULL; UINT uBlockUsed; - if( size > (dwBlockSize - sizeof(DWORD)) ) + if( size > (dwBlockSize - sizeof(BOOL)) ) { FIXME( "Size exceeded. Request of 0x%08x\n", size ); - size = dwBlockSize - sizeof(DWORD); + size = dwBlockSize - sizeof(BOOL); } /* Find blank area */

1 0

Thomas Faber : gameux/tests: Avoid a variable-length array.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: 20dcd96de3622322e7ba3840e14e7666dccdbb02 URL: http://source.winehq.org/git/wine.git/?a=commit;h=20dcd96de3622322e7ba3840e… Author: Thomas Faber <thomas.faber(a)reactos.org> Date: Tue Mar 25 08:37:17 2014 +0100 gameux/tests: Avoid a variable-length array. --- dlls/gameux/tests/gamestatistics.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/dlls/gameux/tests/gamestatistics.c b/dlls/gameux/tests/gamestatistics.c index 7d57b1f..f5dd2ab 100644 --- a/dlls/gameux/tests/gamestatistics.c +++ b/dlls/gameux/tests/gamestatistics.c @@ -130,15 +130,13 @@ static HRESULT _buildStatisticsFilePath(LPCGUID guidApplicationId, LPWSTR *lpSta 'l','o','r','e','r','\\','G','a','m','e','S','t','a','t','i','s', 't','i','c','s','\\',0}; static const WCHAR sDotGamestats[] = {'.','g','a','m','e','s','t','a','t','s',0}; - static const DWORD dwGuidLength = 49; - HRESULT hr; - WCHAR sGuid[dwGuidLength], sPath[MAX_PATH] = {0}; + WCHAR sGuid[49], sPath[MAX_PATH]; hr = pSHGetFolderPathW(NULL, CSIDL_LOCAL_APPDATA, NULL, SHGFP_TYPE_CURRENT, sPath); if(SUCCEEDED(hr)) - hr = (StringFromGUID2(guidApplicationId, sGuid, dwGuidLength)!=0 ? S_OK : E_FAIL); + hr = (StringFromGUID2(guidApplicationId, sGuid, sizeof(sGuid) / sizeof(sGuid[0])) != 0 ? S_OK : E_FAIL); if(SUCCEEDED(hr)) {

1 0

Thomas Faber : gdi32: Avoid variable-length arrays.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: ff3d728d7421fa898da9b78aedb4ddfdf8dc5e84 URL: http://source.winehq.org/git/wine.git/?a=commit;h=ff3d728d7421fa898da9b78ae… Author: Thomas Faber <thomas.faber(a)reactos.org> Date: Tue Mar 25 08:46:00 2014 +0100 gdi32: Avoid variable-length arrays. --- dlls/gdi32/bidi.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/dlls/gdi32/bidi.c b/dlls/gdi32/bidi.c index 1d6be53..066eec3 100644 --- a/dlls/gdi32/bidi.c +++ b/dlls/gdi32/bidi.c @@ -596,10 +596,25 @@ BOOL BIDI_Reorder( if (lpGlyphs && doGlyphs) { - BYTE runOrder[maxItems]; - int visOrder[maxItems]; + BYTE *runOrder; + int *visOrder; SCRIPT_ITEM *curItem; + runOrder = HeapAlloc(GetProcessHeap(), 0, maxItems * sizeof(*runOrder)); + visOrder = HeapAlloc(GetProcessHeap(), 0, maxItems * sizeof(*visOrder)); + if (!runOrder || !visOrder) + { + WARN("Out of memory\n"); + HeapFree(GetProcessHeap(), 0, runOrder); + HeapFree(GetProcessHeap(), 0, visOrder); + HeapFree(GetProcessHeap(), 0, chartype); + HeapFree(GetProcessHeap(), 0, levels); + HeapFree(GetProcessHeap(), 0, pItems); + HeapFree(GetProcessHeap(), 0, psva); + HeapFree(GetProcessHeap(), 0, pwLogClust); + return FALSE; + } + for (j = 0; j < nItems; j++) runOrder[j] = pItems[j].a.s.uBidiLevel; @@ -621,6 +636,8 @@ BOOL BIDI_Reorder( if (!run_glyphs) { WARN("Out of memory\n"); + HeapFree(GetProcessHeap(), 0, runOrder); + HeapFree(GetProcessHeap(), 0, visOrder); HeapFree(GetProcessHeap(), 0, chartype); HeapFree(GetProcessHeap(), 0, levels); HeapFree(GetProcessHeap(), 0, pItems); @@ -655,6 +672,8 @@ BOOL BIDI_Reorder( glyph_i += cOutGlyphs; } } + HeapFree(GetProcessHeap(), 0, runOrder); + HeapFree(GetProcessHeap(), 0, visOrder); } done += i;

1 0

Thomas Faber : msxml3: Avoid a variable-length array.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: 9d79ca78db237d2a420ad734304db991fc598863 URL: http://source.winehq.org/git/wine.git/?a=commit;h=9d79ca78db237d2a420ad7343… Author: Thomas Faber <thomas.faber(a)reactos.org> Date: Tue Mar 25 09:20:22 2014 +0100 msxml3: Avoid a variable-length array. --- dlls/msxml3/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/msxml3/main.c b/dlls/msxml3/main.c index 5967ac0..d67e4e0 100644 --- a/dlls/msxml3/main.c +++ b/dlls/msxml3/main.c @@ -63,9 +63,9 @@ HINSTANCE MSXML_hInstance = NULL; void wineXmlCallbackLog(char const* caller, xmlErrorLevel lvl, char const* msg, va_list ap) { - static const int max_size = 200; enum __wine_debug_class dbcl; - char buff[max_size]; + char buff[200]; + const int max_size = sizeof(buff) / sizeof(buff[0]); int len; switch (lvl)

1 0

Thomas Faber : shell32: Avoid a variable-length array.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: b1b92046c241f637a6b600428fcbf89336eee59d URL: http://source.winehq.org/git/wine.git/?a=commit;h=b1b92046c241f637a6b600428… Author: Thomas Faber <thomas.faber(a)reactos.org> Date: Tue Mar 25 10:51:34 2014 +0100 shell32: Avoid a variable-length array. --- dlls/shell32/shlview_cmenu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dlls/shell32/shlview_cmenu.c b/dlls/shell32/shlview_cmenu.c index 0705948..8170011 100644 --- a/dlls/shell32/shlview_cmenu.c +++ b/dlls/shell32/shlview_cmenu.c @@ -285,9 +285,10 @@ static BOOL CALLBACK Properties_AddPropSheetCallback(HPROPSHEETPAGE hpage, LPARA return TRUE; } +#define MAX_PROP_PAGES 99 + static void DoOpenProperties(ContextMenu *This, HWND hwnd) { - static const UINT MAX_PROP_PAGES = 99; static const WCHAR wszFolder[] = {'F','o','l','d','e','r', 0}; static const WCHAR wszFiletypeAll[] = {'*',0}; LPSHELLFOLDER lpDesktopSF;

1 0

Thomas Faber : ws2_32: Avoid a variable-length array.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: 626040b1acce87e40e0aa2f190bc020b9e2632fc URL: http://source.winehq.org/git/wine.git/?a=commit;h=626040b1acce87e40e0aa2f19… Author: Thomas Faber <thomas.faber(a)reactos.org> Date: Tue Mar 25 16:49:12 2014 +0100 ws2_32: Avoid a variable-length array. --- dlls/ws2_32/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dlls/ws2_32/socket.c b/dlls/ws2_32/socket.c index 42044e6..cdcbb11 100644 --- a/dlls/ws2_32/socket.c +++ b/dlls/ws2_32/socket.c @@ -3337,12 +3337,13 @@ INT WINAPI WS_getsockopt(SOCKET s, INT level, #endif #ifdef HAS_IRDA +#define MAX_IRDA_DEVICES 10 + case WS_SOL_IRLMP: switch(optname) { case WS_IRLMP_ENUMDEVICES: { - static const int MAX_IRDA_DEVICES = 10; char buf[sizeof(struct irda_device_list) + (MAX_IRDA_DEVICES - 1) * sizeof(struct irda_device_info)]; int res; @@ -3402,6 +3403,7 @@ INT WINAPI WS_getsockopt(SOCKET s, INT level, return SOCKET_ERROR; } break; /* case WS_SOL_IRLMP */ +#undef MAX_IRDA_DEVICES #endif /* Levels WS_IPPROTO_TCP and WS_IPPROTO_IP convert directly */

1 0

Thomas Faber : oleview: Avoid variable-length arrays.
by Alexandre Julliard 25 Mar '14

25 Mar '14

Module: wine Branch: master Commit: 644bda381e8ea87248b2ea4590c6ae4fcf337399 URL: http://source.winehq.org/git/wine.git/?a=commit;h=644bda381e8ea87248b2ea459… Author: Thomas Faber <thomas.faber(a)reactos.org> Date: Tue Mar 25 11:27:12 2014 +0100 oleview: Avoid variable-length arrays. --- programs/oleview/details.c | 8 ++++---- programs/oleview/tree.c | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/programs/oleview/details.c b/programs/oleview/details.c index f7bb523..9fdd9f3 100644 --- a/programs/oleview/details.c +++ b/programs/oleview/details.c @@ -158,7 +158,7 @@ static void CreateRegRec(HKEY hKey, HTREEITEM parent, WCHAR *wszKeyName, BOOL ad RegCloseKey(hCurKey); - memmove(&wszData[6], wszData, sizeof(WCHAR[lenData])); + memmove(&wszData[6], wszData, lenData * sizeof(WCHAR)); memcpy(wszData, wszCLSID, sizeof(WCHAR[6])); wszData[5] = '\\'; @@ -187,7 +187,7 @@ static void CreateRegRec(HKEY hKey, HTREEITEM parent, WCHAR *wszKeyName, BOOL ad RegCloseKey(hCurKey); - memmove(&wszData[8], wszData, sizeof(WCHAR[lenData])); + memmove(&wszData[8], wszData, lenData * sizeof(WCHAR)); memcpy(wszData, wszTypeLib, sizeof(WCHAR[8])); wszData[7] = '\\'; RegOpenKeyW(HKEY_CLASSES_ROOT, wszData, &hCurKey); @@ -238,9 +238,9 @@ static void CreateReg(WCHAR *buffer) if(RegQueryValueW(hKey, NULL, wszTree, (LONG *)&lenTree) == ERROR_SUCCESS) { memmove(&wszTree[lenBuffer-lastLenBuffer+3], wszTree, - sizeof(WCHAR[lenTree])); + lenTree * sizeof(WCHAR)); memcpy(wszTree, &buffer[lastLenBuffer], - sizeof(WCHAR[lenBuffer-lastLenBuffer])); + (lenBuffer - lastLenBuffer) * sizeof(WCHAR)); if(lenTree == 1) wszTree[lenBuffer-lastLenBuffer] = '\0'; else diff --git a/programs/oleview/tree.c b/programs/oleview/tree.c index 241c32c..34021e7 100644 --- a/programs/oleview/tree.c +++ b/programs/oleview/tree.c @@ -225,7 +225,7 @@ BOOL CreateRegPath(HTREEITEM item, WCHAR *buffer, int bufSize) int bufLen; BOOL ret; - memset(buffer, 0, sizeof(WCHAR[bufSize])); + memset(buffer, 0, bufSize * sizeof(WCHAR)); memset(&tvi, 0, sizeof(TVITEMW)); tvi.hItem = item; @@ -239,8 +239,8 @@ BOOL CreateRegPath(HTREEITEM item, WCHAR *buffer, int bufSize) if(tvi.lParam && (((ITEM_INFO *)tvi.lParam)->cFlag & (REGPATH|REGTOP))) { bufLen = lstrlenW(((ITEM_INFO *)tvi.lParam)->info); - memmove(&buffer[bufLen], buffer, sizeof(WCHAR[bufSize-bufLen])); - memcpy(buffer, ((ITEM_INFO *)tvi.lParam)->info, sizeof(WCHAR[bufLen])); + memmove(&buffer[bufLen], buffer, (bufSize - bufLen) * sizeof(WCHAR)); + memcpy(buffer, ((ITEM_INFO *)tvi.lParam)->info, bufLen * sizeof(WCHAR)); } if(tvi.lParam && ((ITEM_INFO *)tvi.lParam)->cFlag & REGTOP) break;

1 0