December 2021 - Wine-devel - list.winehq.org

[PATCH] programs/cmd: don't crash on 'if exist' without parameter
by Eric Pouech 20 Dec '21

20 Dec '21

fixes BZ #51598 https://bugs.winehq.org/show_bug.cgi?id=51598 Signed-off-by: Eric Pouech <eric.pouech(a)gmail.com> --- programs/cmd/builtins.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/programs/cmd/builtins.c b/programs/cmd/builtins.c index d0a954d90fa..d14e69e072a 100644 --- a/programs/cmd/builtins.c +++ b/programs/cmd/builtins.c @@ -2811,8 +2811,9 @@ int evaluate_if_condition(WCHAR *p, WCHAR **command, int *test, int *negate) WCHAR *param = WCMD_parameter(p, 1+(*negate), NULL, FALSE, FALSE); int len = lstrlenW(param); + if (!len) goto syntax_err; /* FindFirstFile does not like a directory path ending in '\', append a '.' */ - if (len && param[len-1] == '\\') lstrcatW(param, L"."); + if (param[len-1] == '\\') lstrcatW(param, L"."); hff = FindFirstFileW(param, &fd); *test = (hff != INVALID_HANDLE_VALUE );

1 0

[RFC] msxml3: Fix crashes due to access to invalid context pointer.
by Bernhard Übelacker 20 Dec '21

20 Dec '21

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52073 In function xslt_doc_default_loader a pointer of the stack based variable "xmlParserInputPtr input" is given to bind_url. Later in function import_loader_onDataAvailable this pointer appears as parameter "void *ctxt" which correctly gets casted to "xmlParserInputPtr *input", but in my opinion incorrectly given to xmlNewIOInputStream as parameter "xmlParserCtxtPtr ctxt". In the next call to xmlNewInputStream this xmlParserCtxtPtr is used to increment the input_id member. By accident this input_id member contains the pointer which causes in xmlXPathNodeCollectAndTest the segfault. --- dlls/msxml3/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/msxml3/node.c b/dlls/msxml3/node.c index 721ad54e379..272e438e773 100644 --- a/dlls/msxml3/node.c +++ b/dlls/msxml3/node.c @@ -1329,7 +1329,7 @@ static HRESULT import_loader_onDataAvailable(void *ctxt, char *ptr, DWORD len) inputbuffer = xmlParserInputBufferCreateIO(import_loader_io_read, import_loader_io_close, buffer, XML_CHAR_ENCODING_NONE); - *input = xmlNewIOInputStream(ctxt, inputbuffer, XML_CHAR_ENCODING_NONE); + *input = xmlNewIOInputStream(NULL, inputbuffer, XML_CHAR_ENCODING_NONE); if (!*input) xmlFreeParserInputBuffer(inputbuffer); -- 2.34.1

2 2

[PATCH] win32u: Fix memory leak on error path in PATH_WidenPath (cppcheck)
by Alex Henrie 20 Dec '21

20 Dec '21

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/win32u/path.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/win32u/path.c b/dlls/win32u/path.c index 05123a2f2e4..ada76bb4a7a 100644 --- a/dlls/win32u/path.c +++ b/dlls/win32u/path.c @@ -1616,7 +1616,7 @@ BOOL WINAPI NtGdiFlattenPath( HDC hdc ) static struct gdi_path *PATH_WidenPath(DC *dc) { INT i, j, numStrokes, penWidth, penWidthIn, penWidthOut, size, penStyle; - struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, *pUpPath, *pDownPath; + struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, **pNewStrokes, *pUpPath, *pDownPath; EXTLOGPEN *elp; BYTE *type; DWORD obj_type, joint, endcap, penType; @@ -1681,12 +1681,14 @@ static struct gdi_path *PATH_WidenPath(DC *dc) case PT_MOVETO: numStrokes++; j = 0; - pStrokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); - if(!pStrokes) + pNewStrokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); + if(!pNewStrokes) { free_gdi_path(flat_path); + free(pStrokes); return NULL; } + pStrokes = pNewStrokes; pStrokes[numStrokes - 1] = alloc_gdi_path(0); /* fall through */ case PT_LINETO: -- 2.34.1

2 1

[PATCH v2] win32u: Fix memory leak on error path in PATH_WidenPath (cppcheck)
by Huw Davies 20 Dec '21

20 Dec '21

From: Alex Henrie <alexhenrie24(a)gmail.com> Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> Signed-off-by: Huw Davies <huw(a)codeweavers.com> --- dlls/win32u/path.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/win32u/path.c b/dlls/win32u/path.c index 05123a2f2e4..a87a7ab06c2 100644 --- a/dlls/win32u/path.c +++ b/dlls/win32u/path.c @@ -1616,7 +1616,7 @@ BOOL WINAPI NtGdiFlattenPath( HDC hdc ) static struct gdi_path *PATH_WidenPath(DC *dc) { INT i, j, numStrokes, penWidth, penWidthIn, penWidthOut, size, penStyle; - struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, *pUpPath, *pDownPath; + struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, **new_strokes, *pUpPath, *pDownPath; EXTLOGPEN *elp; BYTE *type; DWORD obj_type, joint, endcap, penType; @@ -1681,12 +1681,14 @@ static struct gdi_path *PATH_WidenPath(DC *dc) case PT_MOVETO: numStrokes++; j = 0; - pStrokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); - if(!pStrokes) + new_strokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); + if (!new_strokes) { free_gdi_path(flat_path); + free(pStrokes); return NULL; } + pStrokes = new_strokes; pStrokes[numStrokes - 1] = alloc_gdi_path(0); /* fall through */ case PT_LINETO: -- 2.23.0

1 0

[PATCH] nsiproxy: Fix memory leaks on error paths in get_ipv6_addr_scope_table (cppcheck)
by Alex Henrie 20 Dec '21

20 Dec '21

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/nsiproxy.sys/tcp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/nsiproxy.sys/tcp.c b/dlls/nsiproxy.sys/tcp.c index 6dd0aaa9b45..0cd81ae86e5 100644 --- a/dlls/nsiproxy.sys/tcp.c +++ b/dlls/nsiproxy.sys/tcp.c @@ -235,7 +235,7 @@ static inline MIB_TCP_STATE tcp_state_to_mib_state( int state ) struct ipv6_addr_scope *get_ipv6_addr_scope_table( unsigned int *size ) { - struct ipv6_addr_scope *table = NULL; + struct ipv6_addr_scope *table = NULL, *new_table; unsigned int table_size = 0, num = 0; #ifdef __linux__ @@ -260,11 +260,12 @@ struct ipv6_addr_scope *get_ipv6_addr_scope_table( unsigned int *size ) { if (!table_size) table_size = 4; else table_size *= 2; - if (!(table = realloc( table, table_size * sizeof(table[0]) ))) + if (!(new_table = realloc( table, table_size * sizeof(table[0]) ))) { fclose( fp ); goto failed; } + table = new_table; } entry = table + num - 1; @@ -292,11 +293,12 @@ struct ipv6_addr_scope *get_ipv6_addr_scope_table( unsigned int *size ) { if (!table_size) table_size = 4; else table_size *= 2; - if (!(table = realloc( table, table_size * sizeof(table[0]) ))) + if (!(new_table = realloc( table, table_size * sizeof(table[0]) ))) { freeifaddrs( addrs ); goto failed; } + table = new_table; } sin6 = (struct sockaddr_in6 *)cur->ifa_addr; -- 2.34.1

2 1

[PATCH] win32u: Use null driver to handle virtual display devices.
by Jacek Caban 20 Dec '21

20 Dec '21

All drivers support UpdateDisplayDevices now, so we can avoid a server call by being explicit in the null driver. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52180 Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/win32u/driver.c | 1 + dlls/win32u/sysparams.c | 48 ++++++++++++----------------------------- 2 files changed, 15 insertions(+), 34 deletions(-)

2 1

[PATCH] ole32: Don't change attr->ObjectName in create_key (cppcheck)
by Alex Henrie 20 Dec '21

20 Dec '21

ObjectName can't point to a local variable because it is used later outside of this function. Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/ole32/compobj.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/dlls/ole32/compobj.c b/dlls/ole32/compobj.c index 815fdcb11d0..66cc81470b1 100644 --- a/dlls/ole32/compobj.c +++ b/dlls/ole32/compobj.c @@ -216,18 +216,16 @@ static NTSTATUS create_key( HKEY *retkey, ACCESS_MASK access, OBJECT_ATTRIBUTES HANDLE subkey, root = attr->RootDirectory; WCHAR *buffer = attr->ObjectName->Buffer; DWORD attrs, pos = 0, i = 0, len = attr->ObjectName->Length / sizeof(WCHAR); - UNICODE_STRING str; while (i < len && buffer[i] != '\\') i++; if (i == len) return status; attrs = attr->Attributes; - attr->ObjectName = &str; while (i < len) { - str.Buffer = buffer + pos; - str.Length = (i - pos) * sizeof(WCHAR); + attr->ObjectName->Buffer = buffer + pos; + attr->ObjectName->Length = (i - pos) * sizeof(WCHAR); status = NtCreateKey( &subkey, access, attr, 0, NULL, 0, NULL ); if (attr->RootDirectory != root) NtClose( attr->RootDirectory ); if (status) return status; @@ -236,8 +234,8 @@ static NTSTATUS create_key( HKEY *retkey, ACCESS_MASK access, OBJECT_ATTRIBUTES pos = i; while (i < len && buffer[i] != '\\') i++; } - str.Buffer = buffer + pos; - str.Length = (i - pos) * sizeof(WCHAR); + attr->ObjectName->Buffer = buffer + pos; + attr->ObjectName->Length = (i - pos) * sizeof(WCHAR); attr->Attributes = attrs; status = NtCreateKey( (PHANDLE)retkey, access, attr, 0, NULL, 0, NULL ); if (attr->RootDirectory != root) NtClose( attr->RootDirectory ); -- 2.34.1

1 0

[PATCH] ws2_32: Fix memory leak on error path in get_local_ips (cppcheck)
by Alex Henrie 20 Dec '21

20 Dec '21

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/ws2_32/protocol.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/dlls/ws2_32/protocol.c b/dlls/ws2_32/protocol.c index 867e9513ca2..56b7379cccc 100644 --- a/dlls/ws2_32/protocol.c +++ b/dlls/ws2_32/protocol.c @@ -806,7 +806,7 @@ static struct hostent *get_local_ips( char *hostname ) IP_ADAPTER_INFO *adapters = NULL, *k; struct hostent *hostlist = NULL; MIB_IPFORWARDTABLE *routes = NULL; - struct route *route_addrs = NULL; + struct route *route_addrs = NULL, *new_route_addrs; DWORD adap_size, route_size, n; /* Obtain the size of the adapter list and routing table, also allocate memory */ @@ -852,9 +852,10 @@ static struct hostent *get_local_ips( char *hostname ) } if (exists) continue; - route_addrs = realloc( route_addrs, (numroutes + 1) * sizeof(struct route) ); - if (!route_addrs) + new_route_addrs = realloc( route_addrs, (numroutes + 1) * sizeof(struct route) ); + if (!new_route_addrs) goto cleanup; + route_addrs = new_route_addrs; route_addrs[numroutes].interface = ifindex; route_addrs[numroutes].metric = ifmetric; route_addrs[numroutes].default_route = ifdefault; -- 2.34.1

1 0

[PATCH] mountmgr: Change scope of variable pvd in VOLUME_GetSuperblockLabel (cppcheck)
by Alex Henrie 20 Dec '21

20 Dec '21

The data in pvd was being accessed through the label_ptr variable after pvd went out of scope. Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/mountmgr.sys/device.c | 43 ++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 23 deletions(-) diff --git a/dlls/mountmgr.sys/device.c b/dlls/mountmgr.sys/device.c index d4f77012bbe..b8a0040195d 100644 --- a/dlls/mountmgr.sys/device.c +++ b/dlls/mountmgr.sys/device.c @@ -398,6 +398,7 @@ static void VOLUME_GetSuperblockLabel( struct volume *volume, HANDLE handle, con { const BYTE *label_ptr = NULL; DWORD label_len; + BYTE pvd[BLOCK_SIZE]; switch (volume->fs_type) { @@ -435,32 +436,28 @@ static void VOLUME_GetSuperblockLabel( struct volume *volume, HANDLE handle, con break; } case FS_UDF: + if(!UDF_Find_PVD(handle, pvd)) { - BYTE pvd[BLOCK_SIZE]; - - if(!UDF_Find_PVD(handle, pvd)) - { - label_len = 0; - break; - } + label_len = 0; + break; + } - /* [E] 3/10.1.4 and [U] 2.1.1 */ - if(pvd[24]==8) - { - label_ptr = pvd + 24 + 1; - label_len = pvd[24+32-1]; - break; - } - else - { - unsigned int i; + /* [E] 3/10.1.4 and [U] 2.1.1 */ + if(pvd[24]==8) + { + label_ptr = pvd + 24 + 1; + label_len = pvd[24+32-1]; + break; + } + else + { + unsigned int i; - label_len = 1 + pvd[24+32-1]; - for (i = 0; i < label_len; i += 2) - volume->label[i/2] = (pvd[24+1+i] << 8) | pvd[24+1+i+1]; - volume->label[label_len] = 0; - return; - } + label_len = 1 + pvd[24+32-1]; + for (i = 0; i < label_len; i += 2) + volume->label[i/2] = (pvd[24+1+i] << 8) | pvd[24+1+i+1]; + volume->label[label_len] = 0; + return; } } if (label_len) RtlMultiByteToUnicodeN( volume->label, sizeof(volume->label) - sizeof(WCHAR), -- 2.34.1

1 0

[PATCH] winedbg: Fix disassemble with end addresses exceeding 32-bit.
by Bernhard Übelacker 18 Dec '21

18 Dec '21

Signed-off-by: Bernhard Übelacker <bernhardu(a)mailbox.org> --- Otherwise winedbg continues disassembling and does not stop at the desired address. --- programs/winedbg/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/programs/winedbg/memory.c b/programs/winedbg/memory.c index 5e01bef5607..0c8e1ee0d19 100644 --- a/programs/winedbg/memory.c +++ b/programs/winedbg/memory.c @@ -769,7 +769,7 @@ void memory_disassemble(const struct dbg_lvalue* xstart, const struct dbg_lvalue* xend, int instruction_count) { static ADDRESS64 last = {0,0,0}; - int stop = 0; + dbg_lgint_t stop = 0; int i; if (!xstart && !xend) -- 2.34.1

1 0