[PATCH v3 0/1] MR9347: windowscodecs: Fix off-by-one check in IcoDecoder_GetFrame.

[zhengyong chen (＠chenzhengyong)]

The frame index should be strictly less than idCount. Previously, an index equal to idCount was not rejected, leading to an out-of-range access.

Signed-off-by: chenzhengyong chenzhengyong(a)uniontech.com

Although this bug was not fatal because subsequent IStream_Read and related functions also perform boundary checks, it is better to catch the invalid index early for clarity and consistency.

--
  v3: windowscodecs: Fix off-by-one check in IcoDecoder_GetFrame.
 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9347

[PATCH v3 1/1] windowscodecs: Fix off-by-one check in IcoDecoder_GetFrame.

[chenzhengyong]

From: chenzhengyong <chenzhengyong(a)uniontech.com>

The frame index should be strictly less than idCount.
Previously, an index equal to idCount was not rejected,
leading to an out-of-range access.

Adjusted the returned error code to match Windows behavior
and added corresponding test cases.

Signed-off-by: chenzhengyong <chenzhengyong(a)uniontech.com>
---
 dlls/windowscodecs/icoformat.c       | 4 ++--
 dlls/windowscodecs/tests/icoformat.c | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/dlls/windowscodecs/icoformat.c b/dlls/windowscodecs/icoformat.c
index ae2ae115e5e..bd8b1a33275 100644
--- a/dlls/windowscodecs/icoformat.c
+++ b/dlls/windowscodecs/icoformat.c
@@ -662,9 +662,9 @@ static HRESULT WINAPI IcoDecoder_GetFrame(IWICBitmapDecoder *iface,
         goto fail;
     }
 
-    if (This->header.idCount < index)
+    if (This->header.idCount <= index)
     {
-        hr = E_INVALIDARG;
+        hr = WINCODEC_ERR_FRAMEMISSING;
         goto fail;
     }
 
diff --git a/dlls/windowscodecs/tests/icoformat.c b/dlls/windowscodecs/tests/icoformat.c
index 32bde262c88..8a96de630b7 100644
--- a/dlls/windowscodecs/tests/icoformat.c
+++ b/dlls/windowscodecs/tests/icoformat.c
@@ -140,6 +140,7 @@ static void test_ico_data_(void *data, DWORD data_size, HRESULT init_hr, int tod
     HRESULT hr;
     IWICStream *icostream;
     IWICBitmapFrameDecode *framedecode = NULL;
+    UINT count;
 
     hr = CoCreateInstance(&CLSID_WICImagingFactory, NULL, CLSCTX_INPROC_SERVER,
         &IID_IWICImagingFactory, (void**)&factory);
@@ -169,6 +170,11 @@ static void test_ico_data_(void *data, DWORD data_size, HRESULT init_hr, int tod
 
             if (SUCCEEDED(hr))
             {
+                hr = IWICBitmapDecoder_GetFrameCount(decoder, &count);
+                ok(hr == S_OK, "GetFrameCount failed, hr=%lx\n", hr);
+                ok(count == 1, "Expected 1 frame, got %u\n", count);
+                hr = IWICBitmapDecoder_GetFrame(decoder, count, &framedecode);
+                ok(hr == WINCODEC_ERR_FRAMEMISSING, "Expected WINCODEC_ERR_FRAMEMISSING from GetFrame, got %lx\n", hr);
                 hr = IWICBitmapDecoder_GetFrame(decoder, 0, &framedecode);
                 ok(hr == S_OK, "GetFrame failed, hr=%lx\n", hr);
             }
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/9347

[PATCH v3 0/1] MR9347: windowscodecs: Fix off-by-one check in IcoDecoder_GetFrame. - approved

[Esme Povirk (＠madewokherd)]

This merge request was approved by Esme Povirk.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9347