Zebediah Figura : msacm32: Add invalid parameter checks for acmFormatChoose().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 84e61e6a07b4dd93a04d74a88cff3b8f5da835a4
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=84e61e6a07b4dd93a04d74a88c...

Author: Zebediah Figura <z.figura12(a)gmail.com>
Date:   Thu Jun 22 18:02:40 2017 -0500

msacm32: Add invalid parameter checks for acmFormatChoose().

Signed-off-by: Zebediah Figura <zfigura(a)codeweavers.com>
Signed-off-by: Andrew Eikum <aeikum(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/msacm32/format.c      |  9 +++++++++
 dlls/msacm32/tests/msacm.c | 26 ++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/dlls/msacm32/format.c b/dlls/msacm32/format.c
index 19a5ceb..24d6ea5 100644
--- a/dlls/msacm32/format.c
+++ b/dlls/msacm32/format.c
@@ -288,6 +288,9 @@ MMRESULT WINAPI acmFormatChooseA(PACMFORMATCHOOSEA pafmtc)
     LPWSTR              templ = NULL;
     DWORD               sz;
 
+    if (pafmtc->cbStruct < sizeof(ACMFORMATCHOOSEA))
+        return MMSYSERR_INVALPARAM;
+
     afcw.cbStruct  = sizeof(afcw);
     afcw.fdwStyle  = pafmtc->fdwStyle;
     afcw.hwndOwner = pafmtc->hwndOwner;
@@ -359,6 +362,12 @@ done:
  */
 MMRESULT WINAPI acmFormatChooseW(PACMFORMATCHOOSEW pafmtc)
 {
+    if (pafmtc->cbStruct < sizeof(ACMFORMATCHOOSEW))
+        return MMSYSERR_INVALPARAM;
+
+    if (!pafmtc->pwfx)
+        return MMSYSERR_INVALPARAM;
+
     if (pafmtc->fdwStyle & ACMFORMATCHOOSE_STYLEF_ENABLETEMPLATEHANDLE)
         return DialogBoxIndirectParamW(MSACM_hInstance32, (LPCDLGTEMPLATEW)pafmtc->hInstance,
                                        pafmtc->hwndOwner, FormatChooseDlgProc, (LPARAM)pafmtc);
diff --git a/dlls/msacm32/tests/msacm.c b/dlls/msacm32/tests/msacm.c
index a485f9a..337e20c 100644
--- a/dlls/msacm32/tests/msacm.c
+++ b/dlls/msacm32/tests/msacm.c
@@ -1249,6 +1249,31 @@ static void test_acmFormatTagDetails(void)
         ok(aftd.cbFormatSize == sizeof(MPEGLAYER3WAVEFORMAT), "got %d\n", aftd.cbFormatSize);
 }
 
+static void test_acmFormatChoose(void)
+{
+    ACMFORMATCHOOSEW afc = {0};
+    WAVEFORMATEX *pwfx;
+    DWORD sizeMax;
+    MMRESULT rc;
+
+    acmMetrics(NULL, ACM_METRIC_MAX_SIZE_FORMAT, &sizeMax);
+    pwfx = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeMax);
+
+    afc.cbStruct = sizeof(afc);
+    afc.pwfx = pwfx;
+
+    /* test invalid struct size */
+    afc.cbStruct = sizeof(afc)-1;
+    rc = acmFormatChooseW(&afc);
+    ok(rc == MMSYSERR_INVALPARAM, "expected 0xb, got 0x%x\n", rc);
+    afc.cbStruct = sizeof(afc);
+
+    afc.pwfx = NULL;
+    rc = acmFormatChooseW(&afc);
+    ok(rc == MMSYSERR_INVALPARAM, "expected 0xb, got 0x%x\n", rc);
+    afc.pwfx = pwfx;
+}
+
 static struct
 {
     struct
@@ -1418,6 +1443,7 @@ START_TEST(msacm)
     test_convert();
     test_acmFormatSuggest();
     test_acmFormatTagDetails();
+    test_acmFormatChoose();
     /* Test acmDriverAdd in the end as it may conflict
      * with other tests due to codec lookup order */
     test_acmDriverAdd();