http://bugs.winehq.org/show_bug.cgi?id=60247 Bug ID: 60247 Summary: SetWindowLongPtr succeeds on a window owned by another process, resulting in a crash Product: Wine Version: 11.11 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: win32u Assignee: wine-bugs@list.winehq.org Reporter: orfeaz+wine@gmail.com Target Milestone: --- Distribution: --- Created attachment 81957 --> http://bugs.winehq.org/attachment.cgi?id=81957 Reproduction code, executable, and logs SetWindowLongPtrW(hwnd, GWLP_WNDPROC, proc) succeeds when hwnd belongs to another process, while it should instead be returning 0 and setting ERROR_ACCESS_DENIED as the error. Wine forwards this to the other process via WM_WINE_SETWINDOWLONG. That process stores the raw pointer as its own window procedure and calls it on the next message, at an address that is not mapped in its address space, causing a crash. I've attached a small repro (source + prebuilt) which follows how I encountered this bug (developing a mod for a game which has this behavior). It allocates a console (spawning conhost.exe), gets the console window handle and calls SetWindowLongPtrW on it, and then sends a message to it using PostMessageW. This causes the application to crash. I've also attached logs from two runs with wine 11.0 and 11.14 (most recent in my distro). This appears to be a regression introduced in wine 11.11 (commit aed4c444fb0f). Up until then, a check for this existed in dlls/win32u/window.c, but in 11.11 it was removed. It seems that now there's only a check on the get path but not the set path. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.