[PATCH 0/1] MR5572: winemac.drv: Fix use-after-free in macdrv_copy_pasteboard_types.

[Brendan Shanks (＠bshanks)]

ObjC dictionary literals are autoreleased, meaning BitmapOutputTypeMap was released at the end of the first call to macdrv_copy_pasteboard_types. Any call after that was liable to crash, depending on whether it was overwritten. More complex objects on the clipboard (like a file copied in the Finder) seemed to trigger a crash, which manifested as explorer.exe taking 100% of CPU (since the main thread crashed, then the SEGV handler crashed because it's not a Wine thread).

Fixes a regression from bb2e02ab66c5c602d635722cf3a5820d6b366006.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/5572

[PATCH 1/1] winemac.drv: Fix use-after-free in macdrv_copy_pasteboard_types.

[Brendan Shanks]

From: Brendan Shanks <bshanks(a)codeweavers.com>

Fixes a regression from bb2e02ab66c5c602d635722cf3a5820d6b366006.
---
 dlls/winemac.drv/cocoa_clipboard.m | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/winemac.drv/cocoa_clipboard.m b/dlls/winemac.drv/cocoa_clipboard.m
index a3dca323705..4994442f1df 100644
--- a/dlls/winemac.drv/cocoa_clipboard.m
+++ b/dlls/winemac.drv/cocoa_clipboard.m
@@ -103,6 +103,7 @@ CFArrayRef macdrv_copy_pasteboard_types(CFTypeRef pasteboard)
             @"com.compuserve.gif" : @(NSBitmapImageFileTypeGIF),
                    @"public.jpeg" : @(NSBitmapImageFileTypeJPEG),
         };
+        [BitmapOutputTypeMap retain];
     });
 
     OnMainThread(^{
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/5572

[Brendan Shanks (＠bshanks)]

Forgot to mention: this bug was also hard to reproduce because macOS 11/Xcode 13 added [ObjC constant literals for collections](https://blog.andrewmadsen.com/2021/06/07/constant-literals-in.html) like NSDictionary. When Wine is built targeting macOS 11 or later, BitmapOutputTypeMap is just constant data and is never released.

As a result, this bug only showed up when targeting macOS 10.15 or earlier (true for CrossOver, usually not true for development builds of Wine).

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/5572#note_69484

[Sven Baars (＠sbaars)]

Oh wow, I wouldn't expect those static dictionary literals to be autoreleased either.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/5572#note_69498

[PATCH 0/1] MR5572: winemac.drv: Fix use-after-free in macdrv_copy_pasteboard_types. - approved

[Sven Baars (＠sbaars)]

This merge request was approved by Sven Baars.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/5572