August 2012 - Wine-Commits - list.winehq.org

Marcus Meissner : user32: Free the correct dce (Coverity).
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: 3fb8a4263868d5db0bd2a4d7321b6e1a2af5db23 URL: http://source.winehq.org/git/wine.git/?a=commit;h=3fb8a4263868d5db0bd2a4d73… Author: Marcus Meissner <marcus(a)jet.franken.de> Date: Fri Aug 17 21:23:38 2012 +0200 user32: Free the correct dce (Coverity). --- dlls/user32/painting.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/user32/painting.c b/dlls/user32/painting.c index 5a3614c..dcf615d 100644 --- a/dlls/user32/painting.c +++ b/dlls/user32/painting.c @@ -314,9 +314,11 @@ static struct dce *get_window_dce( HWND hwnd ) if (dce_to_free) { - SetDCHook( dce->hdc, NULL, 0 ); - DeleteDC( dce->hdc ); - HeapFree( GetProcessHeap(), 0, dce ); + SetDCHook( dce_to_free->hdc, NULL, 0 ); + DeleteDC( dce_to_free->hdc ); + HeapFree( GetProcessHeap(), 0, dce_to_free ); + if (dce_to_free == dce) + dce = NULL; } } return dce;

1 0

Marcus Meissner : quartz: Avoid linked list walk with free next (Coverity).
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: de7635a2f0a1424b14318788f935ff2a3d531a79 URL: http://source.winehq.org/git/wine.git/?a=commit;h=de7635a2f0a1424b14318788f… Author: Marcus Meissner <marcus(a)jet.franken.de> Date: Fri Aug 17 22:36:48 2012 +0200 quartz: Avoid linked list walk with free next (Coverity). --- dlls/quartz/systemclock.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/dlls/quartz/systemclock.c b/dlls/quartz/systemclock.c index 842541b..043299b 100644 --- a/dlls/quartz/systemclock.c +++ b/dlls/quartz/systemclock.c @@ -116,12 +116,15 @@ static DWORD WINAPI SystemClockAdviseThread(LPVOID lpParam) { } /** First SingleShots Advice: sorted list */ - for (it = This->pSingleShotAdvise; NULL != it && (it->rtBaseTime + it->rtIntervalTime) <= curTime; it = it->next) { + it = This->pSingleShotAdvise; + while ((NULL != it) && (it->rtBaseTime + it->rtIntervalTime) <= curTime) { + SystemClockAdviseEntry* nextit = it->next; /** send event ... */ SetEvent(it->hEvent); /** ... and Release it */ QUARTZ_RemoveAviseEntryFromQueue(This, it); CoTaskMemFree(it); + it = nextit; } if (NULL != it) timeOut = (DWORD) ((it->rtBaseTime + it->rtIntervalTime) - curTime) / (REFERENCE_TIME)10000;

1 0

Marcus Meissner : qcap: Fixed a use after free in error path (Coverity).
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: 524ff6fe27cfb0a2f2154b1543134d0e93784c6b URL: http://source.winehq.org/git/wine.git/?a=commit;h=524ff6fe27cfb0a2f2154b154… Author: Marcus Meissner <marcus(a)jet.franken.de> Date: Fri Aug 17 23:04:31 2012 +0200 qcap: Fixed a use after free in error path (Coverity). --- dlls/qcap/v4l.c | 1 + dlls/qcap/vfwcapture.c | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/qcap/v4l.c b/dlls/qcap/v4l.c index 119eb29..1851ba4 100644 --- a/dlls/qcap/v4l.c +++ b/dlls/qcap/v4l.c @@ -314,6 +314,7 @@ HRESULT qcap_driver_get_format(const Capture *capBox, AM_MEDIA_TYPE ** mT) if (!vi) { CoTaskMemFree(mT[0]); + mT[0] = NULL; return E_OUTOFMEMORY; } mT[0]->majortype = MEDIATYPE_Video; diff --git a/dlls/qcap/vfwcapture.c b/dlls/qcap/vfwcapture.c index 68341ae..7be59cc 100644 --- a/dlls/qcap/vfwcapture.c +++ b/dlls/qcap/vfwcapture.c @@ -678,9 +678,10 @@ static HRESULT WINAPI VfwPin_GetMediaType(BasePin *iface, int iPosition, AM_MEDI return VFW_S_NO_MORE_ITEMS; hr = qcap_driver_get_format(This->driver_info, &vfw_pmt); - CopyMediaType(pmt, vfw_pmt); - DeleteMediaType(vfw_pmt); - + if (SUCCEEDED(hr)) { + CopyMediaType(pmt, vfw_pmt); + DeleteMediaType(vfw_pmt); + } return hr; }

1 0

Piotr Caban : msvcp90: Fixed buffer allocation in basic_stringbuf<wchar> class.
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: e40d02868d26a402abc8402299daccd2d6a2f5bb URL: http://source.winehq.org/git/wine.git/?a=commit;h=e40d02868d26a402abc840229… Author: Piotr Caban <piotr(a)codeweavers.com> Date: Sat Aug 18 14:54:17 2012 +0200 msvcp90: Fixed buffer allocation in basic_stringbuf<wchar> class. --- dlls/msvcp100/ios.c | 4 ++-- dlls/msvcp90/ios.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dlls/msvcp100/ios.c b/dlls/msvcp100/ios.c index 1bc8ee2..4969c7b 100644 --- a/dlls/msvcp100/ios.c +++ b/dlls/msvcp100/ios.c @@ -3946,7 +3946,7 @@ void __thiscall basic_stringbuf_wchar__Init(basic_stringbuf_wchar *this, const w this->seekhigh = NULL; if(count && str) { - wchar_t *buf = MSVCRT_operator_new(count); + wchar_t *buf = MSVCRT_operator_new(count*sizeof(wchar_t)); if(!buf) { ERR("Out of memory\n"); throw_exception(EXCEPTION_BAD_ALLOC, NULL); @@ -4120,7 +4120,7 @@ unsigned short __thiscall basic_stringbuf_wchar_overflow(basic_stringbuf_wchar * oldsize = (ptr ? basic_streambuf_wchar_epptr(&this->base)-basic_streambuf_wchar_eback(&this->base): 0); size = oldsize|0xf; size += size/2; - buf = MSVCRT_operator_new(size); + buf = MSVCRT_operator_new(size*sizeof(wchar_t)); if(!buf) { ERR("Out of memory\n"); throw_exception(EXCEPTION_BAD_ALLOC, NULL); diff --git a/dlls/msvcp90/ios.c b/dlls/msvcp90/ios.c index a0e54ad..fd2f6a7 100644 --- a/dlls/msvcp90/ios.c +++ b/dlls/msvcp90/ios.c @@ -3932,7 +3932,7 @@ void __thiscall basic_stringbuf_wchar__Init(basic_stringbuf_wchar *this, const w this->seekhigh = NULL; if(count && str) { - wchar_t *buf = MSVCRT_operator_new(count); + wchar_t *buf = MSVCRT_operator_new(count*sizeof(wchar_t)); if(!buf) { ERR("Out of memory\n"); throw_exception(EXCEPTION_BAD_ALLOC, NULL); @@ -4106,7 +4106,7 @@ unsigned short __thiscall basic_stringbuf_wchar_overflow(basic_stringbuf_wchar * oldsize = (ptr ? basic_streambuf_wchar_epptr(&this->base)-basic_streambuf_wchar_eback(&this->base): 0); size = oldsize|0xf; size += size/2; - buf = MSVCRT_operator_new(size); + buf = MSVCRT_operator_new(size*sizeof(wchar_t)); if(!buf) { ERR("Out of memory\n"); throw_exception(EXCEPTION_BAD_ALLOC, NULL);

1 0

Nikolay Sivov : mscoree: Call interface methods properly.
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: de37c1d57f43d7d56da59091c93971808e5fa80a URL: http://source.winehq.org/git/wine.git/?a=commit;h=de37c1d57f43d7d56da59091c… Author: Nikolay Sivov <nsivov(a)codeweavers.com> Date: Sun Aug 19 21:50:52 2012 +0400 mscoree: Call interface methods properly. --- dlls/mscoree/cordebug.c | 4 ++-- dlls/mscoree/corruntimehost.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dlls/mscoree/cordebug.c b/dlls/mscoree/cordebug.c index da06f49..1a62e14 100644 --- a/dlls/mscoree/cordebug.c +++ b/dlls/mscoree/cordebug.c @@ -88,7 +88,7 @@ static HRESULT WINAPI cordebugprocess_QueryInterface(ICorDebugProcess *iface, return E_NOINTERFACE; } - ICorDebug_AddRef(iface); + ICorDebugProcess_AddRef(iface); return S_OK; } @@ -458,7 +458,7 @@ static HRESULT WINAPI process_enum_QueryInterface(ICorDebugProcessEnum *iface, R return E_NOINTERFACE; } - ICorDebug_AddRef(iface); + ICorDebugProcessEnum_AddRef(iface); return S_OK; } diff --git a/dlls/mscoree/corruntimehost.c b/dlls/mscoree/corruntimehost.c index 0262757..b5ee842 100644 --- a/dlls/mscoree/corruntimehost.c +++ b/dlls/mscoree/corruntimehost.c @@ -941,7 +941,7 @@ static void CDECL ReallyFixupVTable(struct dll_fixup *fixup) } if (info != NULL) - ICLRRuntimeHost_Release(info); + ICLRRuntimeInfo_Release(info); HeapFree(GetProcessHeap(), 0, filenameA);

1 0

Nikolay Sivov : mlang: Call interface methods properly.
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: 64e94c22c9648c5ac2a604602cb33ef85cf4933d URL: http://source.winehq.org/git/wine.git/?a=commit;h=64e94c22c9648c5ac2a604602… Author: Nikolay Sivov <nsivov(a)codeweavers.com> Date: Sun Aug 19 19:55:54 2012 +0400 mlang: Call interface methods properly. --- dlls/mlang/mlang.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dlls/mlang/mlang.c b/dlls/mlang/mlang.c index 2c6e6f7..775a723 100644 --- a/dlls/mlang/mlang.c +++ b/dlls/mlang/mlang.c @@ -2883,7 +2883,7 @@ static HRESULT WINAPI fnIMultiLanguage2_GetLcidFromRfc1766( if (!pLocale || !bstrRfc1766) return E_INVALIDARG; - hr = IMultiLanguage2_EnumRfc1766(iface, 0, &rfc1766); + hr = IMultiLanguage3_EnumRfc1766(iface, 0, &rfc1766); if (FAILED(hr)) return hr; @@ -3094,7 +3094,7 @@ static HRESULT WINAPI fnIMultiLanguage2_ValidateCodePage( UINT uiCodePage, HWND hwnd) { - return IMultiLanguage2_ValidateCodePageEx(iface,uiCodePage,hwnd,0); + return IMultiLanguage3_ValidateCodePageEx(iface,uiCodePage,hwnd,0); } static HRESULT WINAPI fnIMultiLanguage2_GetCodePageDescription( @@ -3132,7 +3132,7 @@ static HRESULT WINAPI fnIMultiLanguage2_IsCodePageInstallable( TRACE("%u\n", uiCodePage); /* FIXME: the installable set is usually larger than the set of valid codepages */ - return IMultiLanguage2_ValidateCodePageEx(iface, uiCodePage, NULL, CPIOD_PEEK); + return IMultiLanguage3_ValidateCodePageEx(iface, uiCodePage, NULL, CPIOD_PEEK); } static HRESULT WINAPI fnIMultiLanguage2_SetMimeDBSource(

1 0

Nikolay Sivov : comctl32: Call interface methods properly.
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: 21897a96892c49e45271dd88dd4c5ca9ccc0fd5f URL: http://source.winehq.org/git/wine.git/?a=commit;h=21897a96892c49e45271dd88d… Author: Nikolay Sivov <nsivov(a)codeweavers.com> Date: Sun Aug 19 19:19:41 2012 +0400 comctl32: Call interface methods properly. --- dlls/comctl32/imagelist.c | 6 +++--- dlls/comctl32/tests/imagelist.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dlls/comctl32/imagelist.c b/dlls/comctl32/imagelist.c index 4d18597..6142ba7 100644 --- a/dlls/comctl32/imagelist.c +++ b/dlls/comctl32/imagelist.c @@ -3366,7 +3366,7 @@ static HRESULT WINAPI ImageListImpl_Copy(IImageList *iface, int iDst, return E_FAIL; /* TODO: Add test for IID_ImageList2 too */ - if (FAILED(IImageList_QueryInterface(punkSrc, &IID_IImageList, + if (FAILED(IUnknown_QueryInterface(punkSrc, &IID_IImageList, (void **) &src))) return E_FAIL; @@ -3390,7 +3390,7 @@ static HRESULT WINAPI ImageListImpl_Merge(IImageList *iface, int i1, TRACE("(%p)->(%d %p %d %d %d %s %p)\n", iface, i1, punk2, i2, dx, dy, debugstr_guid(riid), ppv); /* TODO: Add test for IID_ImageList2 too */ - if (FAILED(IImageList_QueryInterface(punk2, &IID_IImageList, + if (FAILED(IUnknown_QueryInterface(punk2, &IID_IImageList, (void **) &iml2))) return E_FAIL; @@ -3523,7 +3523,7 @@ static HRESULT WINAPI ImageListImpl_SetDragCursorImage(IImageList *iface, return E_FAIL; /* TODO: Add test for IID_ImageList2 too */ - if (FAILED(IImageList_QueryInterface(punk, &IID_IImageList, + if (FAILED(IUnknown_QueryInterface(punk, &IID_IImageList, (void **) &iml2))) return E_FAIL; diff --git a/dlls/comctl32/tests/imagelist.c b/dlls/comctl32/tests/imagelist.c index 2e316f7..98b84a6 100644 --- a/dlls/comctl32/tests/imagelist.c +++ b/dlls/comctl32/tests/imagelist.c @@ -1423,7 +1423,7 @@ static void test_iimagelist(void) /* test reference counting on destruction */ imgl = (IImageList*)createImageList(32, 32); - ret = IUnknown_AddRef(imgl); + ret = IImageList_AddRef(imgl); ok(ret == 2, "Expected 2, got %d\n", ret); ret = ImageList_Destroy((HIMAGELIST)imgl); ok(ret == TRUE, "Expected TRUE, got %d\n", ret); @@ -1433,7 +1433,7 @@ static void test_iimagelist(void) ok(ret == FALSE, "Expected FALSE, got %d\n", ret); imgl = (IImageList*)createImageList(32, 32); - ret = IUnknown_AddRef(imgl); + ret = IImageList_AddRef(imgl); ok(ret == 2, "Expected 2, got %d\n", ret); ret = ImageList_Destroy((HIMAGELIST)imgl); ok(ret == TRUE, "Expected TRUE, got %d\n", ret);

1 0

Nikolay Sivov : browseui: Call interface methods properly.
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: ab5c3ad8dafd6a8fd7ad3ea38bfb4cb6e5ada1bd URL: http://source.winehq.org/git/wine.git/?a=commit;h=ab5c3ad8dafd6a8fd7ad3ea38… Author: Nikolay Sivov <nsivov(a)codeweavers.com> Date: Sun Aug 19 19:15:15 2012 +0400 browseui: Call interface methods properly. --- dlls/browseui/aclmulti.c | 2 +- dlls/browseui/aclsource.c | 2 +- dlls/browseui/progressdlg.c | 2 +- dlls/browseui/tests/progressdlg.c | 8 ++++---- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/dlls/browseui/aclmulti.c b/dlls/browseui/aclmulti.c index 0ca6758..bfb200c 100644 --- a/dlls/browseui/aclmulti.c +++ b/dlls/browseui/aclmulti.c @@ -113,7 +113,7 @@ static HRESULT WINAPI ACLMulti_QueryInterface(IEnumString *iface, REFIID iid, LP if (*ppvOut) { - IUnknown_AddRef(iface); + IEnumString_AddRef(iface); return S_OK; } diff --git a/dlls/browseui/aclsource.c b/dlls/browseui/aclsource.c index c151878..8b3530f 100644 --- a/dlls/browseui/aclsource.c +++ b/dlls/browseui/aclsource.c @@ -72,7 +72,7 @@ static HRESULT WINAPI ACLShellSource_QueryInterface(IACList2 *iface, REFIID iid, if (*ppvOut) { - IUnknown_AddRef(iface); + IACList2_AddRef(iface); return S_OK; } diff --git a/dlls/browseui/progressdlg.c b/dlls/browseui/progressdlg.c index e91d9cb..7d478cc 100644 --- a/dlls/browseui/progressdlg.c +++ b/dlls/browseui/progressdlg.c @@ -291,7 +291,7 @@ static HRESULT WINAPI ProgressDialog_QueryInterface(IProgressDialog *iface, REFI if (*ppvOut) { - IUnknown_AddRef(iface); + IProgressDialog_AddRef(iface); return S_OK; } diff --git a/dlls/browseui/tests/progressdlg.c b/dlls/browseui/tests/progressdlg.c index e4d0e2f..2203714 100644 --- a/dlls/browseui/tests/progressdlg.c +++ b/dlls/browseui/tests/progressdlg.c @@ -39,19 +39,19 @@ static void test_IProgressDialog_QueryInterface(void) return; } - hr = IUnknown_QueryInterface(dlg, &IID_IUnknown, NULL); + hr = IProgressDialog_QueryInterface(dlg, &IID_IUnknown, NULL); ok(hr == E_POINTER, "got 0x%x (expected E_POINTER)\n", hr); - hr = IUnknown_QueryInterface(dlg, &IID_IUnknown, (void**)&unk); + hr = IProgressDialog_QueryInterface(dlg, &IID_IUnknown, (void**)&unk); ok(hr == S_OK, "QueryInterface (IUnknown) returned 0x%x\n", hr); if (SUCCEEDED(hr)) { IUnknown_Release(unk); } - hr = IUnknown_QueryInterface(dlg, &IID_IOleWindow, (void**)&olewindow); + hr = IProgressDialog_QueryInterface(dlg, &IID_IOleWindow, (void**)&olewindow); ok(hr == S_OK, "QueryInterface (IOleWindow) returned 0x%x\n", hr); if (SUCCEEDED(hr)) { - hr = IUnknown_QueryInterface(olewindow, &IID_IProgressDialog, (void**)&dlg2); + hr = IOleWindow_QueryInterface(olewindow, &IID_IProgressDialog, (void**)&dlg2); ok(hr == S_OK, "QueryInterface (IProgressDialog) returned 0x%x\n", hr); if (SUCCEEDED(hr)) { IProgressDialog_Release(dlg2);

1 0

Marcus Meissner : riched20: Fixed pointer to value out of scope (Coverity).
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: 3a2de10a9ccdb6a93930aa76e582d6bc397d0347 URL: http://source.winehq.org/git/wine.git/?a=commit;h=3a2de10a9ccdb6a93930aa76e… Author: Marcus Meissner <marcus(a)jet.franken.de> Date: Sat Aug 18 11:56:12 2012 +0200 riched20: Fixed pointer to value out of scope (Coverity). --- dlls/riched20/editor.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/dlls/riched20/editor.c b/dlls/riched20/editor.c index 18cd159..6221f4b 100644 --- a/dlls/riched20/editor.c +++ b/dlls/riched20/editor.c @@ -292,6 +292,7 @@ static LRESULT ME_StreamInText(ME_TextEditor *editor, DWORD dwFormat, ME_InStrea do { LONG nWideChars = 0; + WCHAR wszText[STREAMIN_BUFFER_SIZE+1]; if (!stream->dwSize) { @@ -305,7 +306,6 @@ static LRESULT ME_StreamInText(ME_TextEditor *editor, DWORD dwFormat, ME_InStrea if (!(dwFormat & SF_UNICODE)) { - WCHAR wszText[STREAMIN_BUFFER_SIZE+1]; char * buf = stream->buffer; DWORD size = stream->dwSize; DWORD cp = CP_ACP;

1 0

Marcus Meissner : user32: Fixed two use-after-free (Coverity).
by Alexandre Julliard Aug. 20, 2012

Aug. 20, 2012

Module: wine Branch: master Commit: 84bb5969120d605ec0f6bbe458851cba4670edaa URL: http://source.winehq.org/git/wine.git/?a=commit;h=84bb5969120d605ec0f6bbe45… Author: Marcus Meissner <marcus(a)jet.franken.de> Date: Fri Aug 17 21:31:34 2012 +0200 user32: Fixed two use-after-free (Coverity). --- dlls/user32/dde_client.c | 15 +++++++++++---- 1 files changed, 11 insertions(+), 4 deletions(-) diff --git a/dlls/user32/dde_client.c b/dlls/user32/dde_client.c index ef3ee3f..90fa4db 100644 --- a/dlls/user32/dde_client.c +++ b/dlls/user32/dde_client.c @@ -1246,14 +1246,18 @@ BOOL WINAPI DdeAbandonTransaction(DWORD idInst, HCONV hConv, DWORD idTransaction { if ((pConv = WDML_GetConv(hConv, TRUE)) && pConv->instance == pInstance) { - for (pXAct = pConv->transactions; pXAct; pXAct = pXAct->next) - { + + pXAct = pConv->transactions; + while (pXAct) { + WDML_XACT *nextXAct = pXAct->next; + if (pXAct->dwTimeout == TIMEOUT_ASYNC && (idTransaction == 0 || pXAct->xActID == idTransaction)) { WDML_UnQueueTransaction(pConv, pXAct); WDML_FreeTransaction(pInstance, pXAct, TRUE); } + pXAct = nextXAct; } } } @@ -1262,13 +1266,16 @@ BOOL WINAPI DdeAbandonTransaction(DWORD idInst, HCONV hConv, DWORD idTransaction for (pConv = pInstance->convs[WDML_CLIENT_SIDE]; pConv; pConv = pConv->next) { if (!(pConv->wStatus & ST_CONNECTED)) continue; - for (pXAct = pConv->transactions; pXAct; pXAct = pXAct->next) - { + pXAct = pConv->transactions; + while (pXAct) { + WDML_XACT *nextXAct = pXAct->next; + if (pXAct->dwTimeout == TIMEOUT_ASYNC) { WDML_UnQueueTransaction(pConv, pXAct); WDML_FreeTransaction(pInstance, pXAct, TRUE); } + pXAct = nextXAct; } } }

1 0