[PATCH 0/1] MR8224: hid/tests: Fix stack use-after-return in test_read_device.

[Yuxuan Shui (＠yshui)]

The read loop could exit while a async read request is still in flight, which
could complete after test_read_device has returned. This results in a stack
use-after-return of `overlapped`.

* * *

Finally had something caught by the unix side AddressSanitizer, PE ASan wouldn't
have caught this.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8224

[PATCH 1/1] hid/tests: Fix stack use-after-return in test_read_device.

[Yuxuan Shui]

From: Yuxuan Shui <yshui(a)codeweavers.com>

The read loop could exit while a async read request is still in flight, which
could complete after test_read_device has returned. This results in a stack
use-after-return of `overlapped`.
---
 dlls/hid/tests/device.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dlls/hid/tests/device.c b/dlls/hid/tests/device.c
index 17617f0e127..2c097a16367 100644
--- a/dlls/hid/tests/device.c
+++ b/dlls/hid/tests/device.c
@@ -370,10 +370,13 @@ static void test_read_device(void)
         trace("REMAINING: %ld ms\n", max_time - spent);
     } while(spent < max_time);
 
+    CancelIo(device);
+    rc = WaitForSingleObject(overlapped.hEvent, timeout);
+    ok(rc == WAIT_OBJECT_0, "Wait for object failed\n");
+
     CloseHandle(overlapped.hEvent);
     rc = HidD_FreePreparsedData(ppd);
     ok(rc, "Failed to free preparsed data(0x%lx)\n", GetLastError());
-    CancelIo(device);
     CloseHandle(device);
     HeapFree(GetProcessHeap(), 0, data);
     HeapFree(GetProcessHeap(), 0, report);
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/8224

[PATCH 0/1] MR8224: hid/tests: Fix stack use-after-return in test_read_device. - approved

[Rémi Bernon]

This merge request was approved by Rémi Bernon.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8224