[PATCH v2 0/1] MR3049: user32: Ignore invalid parameters in DrawTextEx when HDC is invalid
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47089 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> -- v2: user32: Ignore invalid parameters in DrawTextEx when HDC is invalid https://gitlab.winehq.org/wine/wine/-/merge_requests/3049
From: Fabian Maurer <dark.shadow4(a)web.de> Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47089 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> --- dlls/user32/tests/text.c | 32 ++++++++++++++++++++++++++++++++ dlls/user32/text.c | 17 +++++++++++++---- 2 files changed, 45 insertions(+), 4 deletions(-) diff --git a/dlls/user32/tests/text.c b/dlls/user32/tests/text.c index 317fb9a6a29..90fe7421b02 100644 --- a/dlls/user32/tests/text.c +++ b/dlls/user32/tests/text.c @@ -519,6 +519,38 @@ static void test_DrawTextCalcRect(void) ok(textheight==0,"Got textheight from DrawTextExW\n"); ok(dtp.uiLengthDrawn==1337, "invalid dtp.uiLengthDrawn = %i\n",dtp.uiLengthDrawn); } + + /* When passing invalid DC, other parameters must be ignored - no crashes on invalid pointers */ + SetLastError(0xdeadbeef); + textheight = DrawTextExW((HDC)0xdeadbeef, emptystringW, 100000, (LPRECT)0xdeadbeef, 0, 0); + ok(textheight == 0, "Got textheight from DrawTextExW\n"); + ok(GetLastError() == 0xdeadbeef,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExW((HDC)0xdeadbeef, (LPWSTR)0xdeadbeef, 100000, &rect, 0, 0); + ok(textheight == 0, "Got textheight from DrawTextExW\n"); + ok(GetLastError() == 0xdeadbeef,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExW((HDC)0xdeadbeef, 0, -1, (LPRECT)0xdeadbeef, DT_CALCRECT, 0); + ok(textheight == 0, "Got textheight from DrawTextExW\n"); + ok(GetLastError() == 0xdeadbeef,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExA((HDC)0xdeadbeef, emptystring, 100000, (LPRECT)0xdeadbeef, 0, 0); + ok(textheight == 0, "Got textheight from DrawTextExA\n"); + ok(GetLastError() == ERROR_INVALID_PARAMETER || GetLastError() == ERROR_INVALID_HANDLE,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExA((HDC)0xdeadbeef, 0, -1, (LPRECT)0xdeadbeef, DT_CALCRECT, 0); + ok(textheight == 0, "Got textheight from DrawTextExA\n"); + ok(GetLastError() == ERROR_INVALID_PARAMETER || GetLastError() == ERROR_INVALID_HANDLE,"Got error %lu\n", GetLastError()); + + if (0) + { + /* Crashes */ + textheight = DrawTextExA((HDC)0xdeadbeef, (LPSTR)0xdeadbeef, 100, &rect, 0, 0); + } } /* More test cases from bug 12226 */ diff --git a/dlls/user32/text.c b/dlls/user32/text.c index 86946e6a53a..4836fa2da3a 100644 --- a/dlls/user32/text.c +++ b/dlls/user32/text.c @@ -874,8 +874,7 @@ INT WINAPI DrawTextExW( HDC hdc, LPWSTR str, INT i_count, int len, lh, count=i_count; TEXTMETRICW tm; int lmargin = 0, rmargin = 0; - int x = rect->left, y = rect->top; - int width = rect->right - rect->left; + int x, y, width; int max_width = 0; int last_line; int tabwidth /* to keep gcc happy */ = 0; @@ -897,7 +896,13 @@ INT WINAPI DrawTextExW( HDC hdc, LPWSTR str, INT i_count, if (flags & DT_SINGLELINE) flags &= ~DT_WORDBREAK; - GetTextMetricsW(hdc, &tm); + if (!GetTextMetricsW(hdc, &tm)) + return 0; + + x = rect->left; + y = rect->top; + width = rect->right - rect->left; + if (flags & DT_EXTERNALLEADING) lh = tm.tmHeight + tm.tmExternalLeading; else @@ -1097,7 +1102,11 @@ INT WINAPI DrawTextExA( HDC hdc, LPSTR str, INT count, if (dtp && dtp->cbSize != sizeof(DRAWTEXTPARAMS)) return 0; - GetTextMetricsA(hdc, &tm); + if (!GetTextMetricsA(hdc, &tm)) + { + SetLastError(ERROR_INVALID_HANDLE); + return 0; + } if (flags & DT_EXTERNALLEADING) lh = tm.tmHeight + tm.tmExternalLeading; else -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/3049
Hi, It looks like your patch introduced the new failures shown below. Please investigate and fix them before resubmitting your patch. If they are not new, fixing them anyway would help a lot. Otherwise please ask for the known failures list to be updated. The tests also ran into some preexisting test failures. If you know how to fix them that would be helpful. See the TestBot job for the details: The full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=133708 Your paranoid android. === debian11 (32 bit report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit ar:MA report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit de report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit fr report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit he:IL report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit hi:IN report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7bc3a389). === debian11 (32 bit ja:JP report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032c40). === debian11 (32 bit zh:CN report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032c40). === debian11b (32 bit WoW report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd).
On Mon Jun 12 20:36:39 2023 +0000, **** wrote:
Marvin replied on the mailing list: ``` Hi, It looks like your patch introduced the new failures shown below. Please investigate and fix them before resubmitting your patch. If they are not new, fixing them anyway would help a lot. Otherwise please ask for the known failures list to be updated. The tests also ran into some preexisting test failures. If you know how to fix them that would be helpful. See the TestBot job for the details: The full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=133703 Your paranoid android. === w7u_2qxl (32 bit report) === user32: text.c:533: Test failed: Got error 6 0748:text: unhandled exception c0000005 at 77D9312E === w7u_adm (32 bit report) === user32: text.c:533: Test failed: Got error 6 0864:text: unhandled exception c0000005 at 7795312E === w7u_el (32 bit report) === user32: text.c:533: Test failed: Got error 6 0344:text: unhandled exception c0000005 at 7739312E === w8 (32 bit report) === user32: text.c:533: Test failed: Got error 6 0adc:text: unhandled exception c0000005 at 76F4A95F === w8adm (32 bit report) === user32: text.c:533: Test failed: Got error 6 0ad0:text: unhandled exception c0000005 at 776CA95F === w864 (32 bit report) === user32: 0b6c:text: unhandled exception c0000005 at 77A8470C === w1064v1507 (32 bit report) === user32: 0ca0:text: unhandled exception c0000005 at 7738111C === w1064v1809 (32 bit report) === user32: 1dbc:text: unhandled exception c0000005 at 77E9105B === w1064_tsign (32 bit report) === user32: 1e4c:text: unhandled exception c0000005 at 77BB200C === w10pro64 (32 bit report) === user32: 1c9c:text: unhandled exception c0000005 at 77021ECC === w11pro64 (32 bit report) === user32: 1e54:text: unhandled exception c0000005 at 770F8495 === w7pro64 (64 bit report) === user32: text.c:533: Test failed: Got error 6 0ac4:text: unhandled exception c0000005 at 0000000076FDF1EF === w864 (64 bit report) === user32: text.c:533: Test failed: Got error 6 054c:text: unhandled exception c0000005 at 00007FFDCF49071F === w1064v1507 (64 bit report) === user32: text.c:533: Test failed: Got error 6 0e54:text: unhandled exception c0000005 at 00007FFD62533A26 === w1064v1809 (64 bit report) === user32: text.c:533: Test failed: Got error 6 1804:text: unhandled exception c0000005 at 00007FFB7E495D45 === w1064_2qxl (64 bit report) === user32: text.c:533: Test failed: Got error 6 0a04:text: unhandled exception c0000005 at 00007FF8B923EBD7 === w1064_adm (64 bit report) === user32: text.c:533: Test failed: Got error 6 1d94:text: unhandled exception c0000005 at 00007FFFA49BEBD7 === w1064_tsign (64 bit report) === user32: text.c:533: Test failed: Got error 6 1d9c:text: unhandled exception c0000005 at 00007FF8F631EBD7 === w10pro64 (64 bit report) === user32: text.c:533: Test failed: Got error 6 20e8:text: unhandled exception c0000005 at 00007FFF2EE7EB87 === w10pro64_en_AE_u8 (64 bit report) === user32: text.c:533: Test failed: Got error 6 22ac:text: unhandled exception c0000005 at 00007FFA74CC94CC === w10pro64_ar (64 bit report) === user32: text.c:533: Test failed: Got error 6 0640:text: unhandled exception c0000005 at 00007FFA0991EB87 === w10pro64_ja (64 bit report) === user32: text.c:533: Test failed: Got error 6 0c20:text: unhandled exception c0000005 at 00007FF96EADE7B0 === w10pro64_zh_CN (64 bit report) === user32: text.c:533: Test failed: Got error 6 0ca4:text: unhandled exception c0000005 at 00007FF8B574E7B0 === w11pro64_amd (64 bit report) === user32: text.c:533: Test failed: Got error 6 23f4:text: unhandled exception c0000005 at 00007FF99E0EE276 ``` Pushed an update.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/3049#note_35514
participants (3)
-
Fabian Maurer -
Fabian Maurer (＠DarkShadow44)
-
Marvin