[Bug 60247] New: SetWindowLongPtr succeeds on a window owned by another process, resulting in a crash

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60247

            Bug ID: 60247
           Summary: SetWindowLongPtr succeeds on a window owned by another
                    process, resulting in a crash
           Product: Wine
           Version: 11.11
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: win32u
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

Created attachment 81957
  --> http://bugs.winehq.org/attachment.cgi?id=81957
Reproduction code, executable, and logs

SetWindowLongPtrW(hwnd, GWLP_WNDPROC, proc) succeeds when hwnd belongs to
another process, while it should instead be returning 0 and setting
ERROR_ACCESS_DENIED as the error.

Wine forwards this to the other process via WM_WINE_SETWINDOWLONG. That process
stores the raw pointer as its own window procedure and calls it on the next
message, at an address that is not mapped in its address space, causing a
crash.

I've attached a small repro (source + prebuilt) which follows how I encountered
this bug (developing a mod for a game which has this behavior). It allocates a
console (spawning conhost.exe), gets the console window handle and calls
SetWindowLongPtrW on it, and then sends a message to it using PostMessageW.
This causes the application to crash. I've also attached logs from two runs
with wine 11.0 and 11.14 (most recent in my distro).

This appears to be a regression introduced in wine 11.11 (commit aed4c444fb0f).
Up until then, a check for this existed in dlls/win32u/window.c, but in 11.11
it was removed. It seems that now there's only a check on the get path but not
the set path.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 60247] SetWindowLongPtr succeeds on a window owned by another process, resulting in a crash

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60247

OrfeasZ <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |regression

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.