[PATCH 0/2] MR9168: windows.devices.enumeration: Fix two memory bugs

[Yuxuan Shui (＠yshui)]

Found by ASan.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9168

[PATCH 1/2] windows.devices.enumeration: Fix use-after-realloc in devpropcompkeys_append_names.

[Yuxuan Shui]

From: Yuxuan Shui <yshui(a)codeweavers.com>

---
 dlls/windows.devices.enumeration/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/windows.devices.enumeration/main.c b/dlls/windows.devices.enumeration/main.c
index 8a6596b682f..37db9e53f24 100644
--- a/dlls/windows.devices.enumeration/main.c
+++ b/dlls/windows.devices.enumeration/main.c
@@ -527,7 +527,7 @@ static HRESULT WINAPI devpropcompkeys_append_names( DEVPROPCOMPKEY **ret_keys, U
         WindowsDeleteString( name );
         if (FAILED(hr)) break;
         /* DevGetObjects(Ex) will not de-duplicate properties, so we need to do it ourselves. */
-        if (!devpropcompkey_buf_find_devpropkey( *ret_keys, keys_len, key.Key ))
+        if (!devpropcompkey_buf_find_devpropkey( keys, keys_len, key.Key ))
             keys[keys_len++] = key;
     }
 
-- 
GitLab


https://gitlab.winehq.org/wine/wine/-/merge_requests/9168

[PATCH 2/2] windows.devices.enumeration: Don't leave dangling pointers if devpropcompkeys_append_names fails.

[Yuxuan Shui]

From: Yuxuan Shui <yshui(a)codeweavers.com>

If devpropcompkeys_append_names fails after the realloc, *ret_keys will contain a dangling pointer.
But both of its callers assume it's safe to call free on *ret_keys when
devpropcompkeys_append_names fails, resulting in double freeing.
---
 dlls/windows.devices.enumeration/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dlls/windows.devices.enumeration/main.c b/dlls/windows.devices.enumeration/main.c
index 37db9e53f24..6a4505c9649 100644
--- a/dlls/windows.devices.enumeration/main.c
+++ b/dlls/windows.devices.enumeration/main.c
@@ -510,6 +510,8 @@ static HRESULT WINAPI devpropcompkeys_append_names( DEVPROPCOMPKEY **ret_keys, U
 
     if (FAILED(hr = count_iterable( names_iterable, &count ))) return hr;
     if (!(keys = realloc( *ret_keys, (keys_len + count) * sizeof( *keys ) ))) return E_OUTOFMEMORY;
+    *ret_keys = NULL;
+    *ret_keys_len = 0;
 
     if (FAILED(hr = IIterable_HSTRING_First( names_iterable, &names ))) return hr;
     for (hr = IIterator_HSTRING_get_HasCurrent( names, &valid ); SUCCEEDED( hr ) && valid; hr = IIterator_HSTRING_MoveNext( names, &valid ))
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/9168

[PATCH 0/2] MR9168: windows.devices.enumeration: Fix two memory bugs - approved

[Vibhav Pant (＠vibhavp)]

This merge request was approved by Vibhav Pant.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9168