[PATCH 0/1] MR489: jscript: return ParseProcedureText when compile fails.

[Santino Mazza (＠tati1454)]

This prevents crashes when there is an invalid script
inside a tag property.

Because ParseProcedureText calls release_bytecode without
checking if compile_script failed, "code" is not set, and
this leads to a crash when release_bytecode tries to access it.

To reproduce the bug you can create an html file and create a tag
with a property having invalid JS in it. For example:

```
<script onerror="alert("></script>
```

Then you just open this file with iexplore.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/489

[PATCH 1/1] jscript: return ParseProcedureText when compile fails.

[Santino Mazza]

From: Santino Mazza <mazzasantino1206(a)gmail.com>

This prevents crashes when there is an invalid script
inside a tag property.

Because ParseProcedureText calls release_bytecode without
checking if compile_script failed, "code" is not set, and
this leads to a crash when release_bytecode tries to access it.

Signed-off-by: Santino Mazza <mazzasantino1206(a)gmail.com>
---
 dlls/jscript/jscript.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/jscript.c b/dlls/jscript/jscript.c
index 8a54f32f234..190a2876900 100644
--- a/dlls/jscript/jscript.c
+++ b/dlls/jscript/jscript.c
@@ -1197,9 +1197,12 @@ static HRESULT WINAPI JScriptParseProcedure_ParseProcedureText(IActiveScriptPars
     enter_script(This->ctx, &ei);
     hres = compile_script(This->ctx, pstrCode, dwSourceContextCookie, ulStartingLineNumber, pstrFormalParams,
                           pstrDelimiter, FALSE, This->is_encode, item, &code);
-    if(SUCCEEDED(hres))
-        hres = create_source_function(This->ctx, code, &code->global_code, NULL,  &dispex);
+    if(FAILED(hres))
+        return leave_script(This->ctx, hres);
+
+    hres = create_source_function(This->ctx, code, &code->global_code, NULL, &dispex);
     release_bytecode(code);
+
     hres = leave_script(This->ctx, hres);
     if(FAILED(hres))
         return hres;
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/489