[PATCH v3 0/1] MR3049: user32: Ignore invalid parameters in DrawTextEx when HDC is invalid
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47089 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> -- v3: user32: Ignore invalid parameters in DrawTextEx when HDC is invalid https://gitlab.winehq.org/wine/wine/-/merge_requests/3049
From: Fabian Maurer <dark.shadow4(a)web.de> Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47089 Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de> --- dlls/user32/tests/text.c | 32 ++++++++++++++++++++++++++++++++ dlls/user32/text.c | 21 ++++++++++++++++----- 2 files changed, 48 insertions(+), 5 deletions(-) diff --git a/dlls/user32/tests/text.c b/dlls/user32/tests/text.c index 317fb9a6a29..90fe7421b02 100644 --- a/dlls/user32/tests/text.c +++ b/dlls/user32/tests/text.c @@ -519,6 +519,38 @@ static void test_DrawTextCalcRect(void) ok(textheight==0,"Got textheight from DrawTextExW\n"); ok(dtp.uiLengthDrawn==1337, "invalid dtp.uiLengthDrawn = %i\n",dtp.uiLengthDrawn); } + + /* When passing invalid DC, other parameters must be ignored - no crashes on invalid pointers */ + SetLastError(0xdeadbeef); + textheight = DrawTextExW((HDC)0xdeadbeef, emptystringW, 100000, (LPRECT)0xdeadbeef, 0, 0); + ok(textheight == 0, "Got textheight from DrawTextExW\n"); + ok(GetLastError() == 0xdeadbeef,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExW((HDC)0xdeadbeef, (LPWSTR)0xdeadbeef, 100000, &rect, 0, 0); + ok(textheight == 0, "Got textheight from DrawTextExW\n"); + ok(GetLastError() == 0xdeadbeef,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExW((HDC)0xdeadbeef, 0, -1, (LPRECT)0xdeadbeef, DT_CALCRECT, 0); + ok(textheight == 0, "Got textheight from DrawTextExW\n"); + ok(GetLastError() == 0xdeadbeef,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExA((HDC)0xdeadbeef, emptystring, 100000, (LPRECT)0xdeadbeef, 0, 0); + ok(textheight == 0, "Got textheight from DrawTextExA\n"); + ok(GetLastError() == ERROR_INVALID_PARAMETER || GetLastError() == ERROR_INVALID_HANDLE,"Got error %lu\n", GetLastError()); + + SetLastError(0xdeadbeef); + textheight = DrawTextExA((HDC)0xdeadbeef, 0, -1, (LPRECT)0xdeadbeef, DT_CALCRECT, 0); + ok(textheight == 0, "Got textheight from DrawTextExA\n"); + ok(GetLastError() == ERROR_INVALID_PARAMETER || GetLastError() == ERROR_INVALID_HANDLE,"Got error %lu\n", GetLastError()); + + if (0) + { + /* Crashes */ + textheight = DrawTextExA((HDC)0xdeadbeef, (LPSTR)0xdeadbeef, 100, &rect, 0, 0); + } } /* More test cases from bug 12226 */ diff --git a/dlls/user32/text.c b/dlls/user32/text.c index 86946e6a53a..788ed10269c 100644 --- a/dlls/user32/text.c +++ b/dlls/user32/text.c @@ -874,8 +874,7 @@ INT WINAPI DrawTextExW( HDC hdc, LPWSTR str, INT i_count, int len, lh, count=i_count; TEXTMETRICW tm; int lmargin = 0, rmargin = 0; - int x = rect->left, y = rect->top; - int width = rect->right - rect->left; + int x, y, width; int max_width = 0; int last_line; int tabwidth /* to keep gcc happy */ = 0; @@ -897,7 +896,13 @@ INT WINAPI DrawTextExW( HDC hdc, LPWSTR str, INT i_count, if (flags & DT_SINGLELINE) flags &= ~DT_WORDBREAK; - GetTextMetricsW(hdc, &tm); + if (!GetTextMetricsW(hdc, &tm)) + return 0; + + x = rect->left; + y = rect->top; + width = rect->right - rect->left; + if (flags & DT_EXTERNALLEADING) lh = tm.tmHeight + tm.tmExternalLeading; else @@ -1086,18 +1091,24 @@ INT WINAPI DrawTextExA( HDC hdc, LPSTR str, INT count, DWORD wmax; DWORD amax; UINT cp; + TEXTMETRICA tm; + + if (!GetTextMetricsA(hdc, &tm)) + { + SetLastError(ERROR_INVALID_HANDLE); + return 0; + } if (!count) return 0; if (!str && count > 0) return 0; if( !str || ((count == -1) && !(count = strlen(str)))) { int lh; - TEXTMETRICA tm; if (dtp && dtp->cbSize != sizeof(DRAWTEXTPARAMS)) return 0; - GetTextMetricsA(hdc, &tm); + if (flags & DT_EXTERNALLEADING) lh = tm.tmHeight + tm.tmExternalLeading; else -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/3049
On Mon Jun 12 21:58:39 2023 +0000, **** wrote:
Marvin replied on the mailing list: ``` Hi, It looks like your patch introduced the new failures shown below. Please investigate and fix them before resubmitting your patch. If they are not new, fixing them anyway would help a lot. Otherwise please ask for the known failures list to be updated. The tests also ran into some preexisting test failures. If you know how to fix them that would be helpful. See the TestBot job for the details: The full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=133708 Your paranoid android. === debian11 (32 bit report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit ar:MA report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit de report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit fr report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit he:IL report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). === debian11 (32 bit hi:IN report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7bc3a389). === debian11 (32 bit ja:JP report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032c40). === debian11 (32 bit zh:CN report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032c40). === debian11b (32 bit WoW report) === user32: Unhandled exception: page fault on read access to 0x00636000 in 32-bit code (0x7b032abd). ``` That's v2, already updated the patchset.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/3049#note_35548
Any new on this? -- https://gitlab.winehq.org/wine/wine/-/merge_requests/3049#note_37830
participants (2)
-
Fabian Maurer -
Fabian Maurer (＠DarkShadow44)