[PATCH v2 0/5] MR4590: mciwave: Use matching memory allocator (Coverity).
*pszTmpFileName will be freed with free() but it's allocated with HeapAlloc(). -- v2: ntdll: Fix a memory leak (Coverity). shell32: Fix a memory leak (Coverity). wininet: Fix a use-after-free (Coverity). tasklist: Fix a possible buffer overrun (Coverity). https://gitlab.winehq.org/wine/wine/-/merge_requests/4590
From: Zhiyi Zhang <zzhang(a)codeweavers.com> *pszTmpFileName will be freed with free() but it's allocated with HeapAlloc(). --- dlls/mciwave/mciwave.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dlls/mciwave/mciwave.c b/dlls/mciwave/mciwave.c index b17c347258f..f2af38b8762 100644 --- a/dlls/mciwave/mciwave.c +++ b/dlls/mciwave/mciwave.c @@ -432,9 +432,7 @@ static DWORD create_tmp_file(HMMIO* hFile, LPWSTR* pszTmpFileName) return MCIERR_FILE_NOT_FOUND; } - *pszTmpFileName = HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - MAX_PATH * sizeof(WCHAR)); + *pszTmpFileName = calloc(1, MAX_PATH * sizeof(WCHAR)); if (!GetTempFileNameW(szTmpPath, szPrefix, 0, *pszTmpFileName)) { WARN("can't retrieve temp file name!\n"); free(*pszTmpFileName); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/4590
From: Zhiyi Zhang <zzhang(a)codeweavers.com> process_entry->szExeFile has length of MAX_PATH but info->image_name only has 32. --- programs/tasklist/tasklist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/programs/tasklist/tasklist.c b/programs/tasklist/tasklist.c index 4f866f6b727..6bbb9921d4f 100644 --- a/programs/tasklist/tasklist.c +++ b/programs/tasklist/tasklist.c @@ -176,7 +176,7 @@ static BOOL tasklist_get_process_info(const PROCESSENTRY32W *process_entry, stru info->pid_value = process_entry->th32ProcessID; info->memory_usage_value = memory_counters.WorkingSetSize / 1024; info->session_id_value = session_id; - wcscpy(info->image_name, process_entry->szExeFile); + lstrcpynW(info->image_name, process_entry->szExeFile, ARRAY_SIZE(info->image_name)); swprintf(info->pid, ARRAY_SIZE(info->pid), L"%u", process_entry->th32ProcessID); wcscpy(info->session_name, session_id == 0 ? L"Services" : L"Console"); swprintf(info->session_number, ARRAY_SIZE(info->session_number), L"%u", session_id); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/4590
From: Zhiyi Zhang <zzhang(a)codeweavers.com> pEntry could be freed after cache_container_unlock_index(pContainer, pHeader). --- dlls/wininet/urlcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/wininet/urlcache.c b/dlls/wininet/urlcache.c index 8e43eaae9f3..7975071ce91 100644 --- a/dlls/wininet/urlcache.c +++ b/dlls/wininet/urlcache.c @@ -2550,8 +2550,8 @@ BOOL WINAPI UnlockUrlCacheEntryFileA(LPCSTR lpszUrlName, DWORD dwReserved) pEntry = (entry_header*)((LPBYTE)pHeader + pHashEntry->offset); if (pEntry->signature != URL_SIGNATURE) { - cache_container_unlock_index(pContainer, pHeader); FIXME("Trying to retrieve entry of unknown format %s\n", debugstr_an((LPSTR)&pEntry->signature, sizeof(DWORD))); + cache_container_unlock_index(pContainer, pHeader); SetLastError(ERROR_FILE_NOT_FOUND); return FALSE; } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/4590
From: Zhiyi Zhang <zzhang(a)codeweavers.com> --- dlls/shell32/dde.c | 1 + 1 file changed, 1 insertion(+) diff --git a/dlls/shell32/dde.c b/dlls/shell32/dde.c index 976dc2e394a..eea8b8ec4ce 100644 --- a/dlls/shell32/dde.c +++ b/dlls/shell32/dde.c @@ -165,6 +165,7 @@ static inline HDDEDATA Dde_OnRequest(UINT uFmt, HCONV hconv, HSZ hszTopic, { free(groups_data); free(programs); + FindClose(hfind); return NULL; } groups_data = new_groups_data; -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/4590
From: Zhiyi Zhang <zzhang(a)codeweavers.com> --- dlls/ntdll/unix/loader.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dlls/ntdll/unix/loader.c b/dlls/ntdll/unix/loader.c index aa120ae38ec..5673fdb38cb 100644 --- a/dlls/ntdll/unix/loader.c +++ b/dlls/ntdll/unix/loader.c @@ -438,7 +438,12 @@ static void init_paths( char *argv[] ) data_dir = build_path( bin_dir, BIN_TO_DATADIR ); wineloader = build_path( bin_dir, basename ); } - else wineloader = build_path( build_path( build_dir, "loader" ), basename ); + else + { + char *dirname = build_path( build_dir, "loader" ); + wineloader = build_path( dirname, basename ); + free(dirname); + } asprintf( &env, "WINELOADER=%s", wineloader ); putenv( env ); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/4590
participants (2)
-
Zhiyi Zhang -
Zhiyi Zhang (＠zhiyi)