[PATCH 0/1] MR7756: uiautomationcore/tests: Fix use-after-free (ASan).

[Nikolay Sivov (＠nsivov)]

Avoid touching original variant value after it's been transferred
with set_property_condition().

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7756

[PATCH 1/1] uiautomationcore/tests: Fix use-after-free (ASan).

[Nikolay Sivov]

From: Nikolay Sivov <nsivov(a)codeweavers.com>

Avoid touching original variant value after it's been transferred
with set_property_condition().

Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com>
---
 dlls/uiautomationcore/tests/uiautomation.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dlls/uiautomationcore/tests/uiautomation.c b/dlls/uiautomationcore/tests/uiautomation.c
index 25271ebe743..e49fb668cc8 100644
--- a/dlls/uiautomationcore/tests/uiautomation.c
+++ b/dlls/uiautomationcore/tests/uiautomation.c
@@ -10035,14 +10035,14 @@ static void test_UiaGetUpdatedCache(void)
 
         SafeArrayDestroy(out_req);
         SysFreeString(tree_struct);
-        VariantClear(&v);
+        VariantClear(&prop_cond.Value);
 
         /* Same values, except we're short by one element. */
         V_VT(&v) = VT_I4 | VT_ARRAY;
         V_ARRAY(&v) = SafeArrayCreateVector(VT_I4, 0, ARRAY_SIZE(uia_i4_arr_prop_val) - 1);
 
         for (i = 0; i < ARRAY_SIZE(uia_i4_arr_prop_val) - 1; i++)
-            SafeArrayPutElement(V_ARRAY(&prop_cond.Value), &i, (void *)&uia_i4_arr_prop_val[i]);
+            SafeArrayPutElement(V_ARRAY(&v), &i, (void *)&uia_i4_arr_prop_val[i]);
 
         set_property_condition(&prop_cond, UIA_OutlineColorPropertyId, &v, PropertyConditionFlags_None);
         set_cache_request(&cache_req, (struct UiaCondition *)&prop_cond, TreeScope_Element, NULL, 0, NULL, 0,
@@ -10057,7 +10057,7 @@ static void test_UiaGetUpdatedCache(void)
         ok(!wcscmp(tree_struct, L""), "tree structure %s\n", debugstr_w(tree_struct));
 
         SysFreeString(tree_struct);
-        VariantClear(&v);
+        VariantClear(&prop_cond.Value);
     }
     else
         win_skip("UIA_OutlineColorPropertyId unavailable, skipping property condition tests for it.\n");
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/7756

[PATCH 0/1] MR7756: uiautomationcore/tests: Fix use-after-free (ASan). - approved

[Connor McAdams (＠cmcadams)]

This merge request was approved by Connor McAdams.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/7756