May 2019 - Wine-Devel - list.winehq.org

[PATCH] shell32: Fix a use after free (Coverity).
by Sven Baars May 28, 2019

May 28, 2019

Signed-off-by: Sven Baars <sven.wine(a)gmail.com> --- dlls/shell32/shellitem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dlls/shell32/shellitem.c b/dlls/shell32/shellitem.c index fc95e7c227..b9e4903a97 100644 --- a/dlls/shell32/shellitem.c +++ b/dlls/shell32/shellitem.c @@ -1289,9 +1289,11 @@ HRESULT WINAPI SHCreateShellItemArray(PCIDLIST_ABSOLUTE pidlParent, if(SUCCEEDED(ret)) { ret = create_shellitemarray(array, cidl, ppsiItemArray); - heap_free(array); if(SUCCEEDED(ret)) + { + heap_free(array); return ret; + } } /* Something failed, clean up. */ -- 2.17.1

1 0

[PATCH 2/2] ntdll: Extend NtGetTickCount() to return 64-bits. Forward kernel32 functions to it.
by Huw Davies May 28, 2019

May 28, 2019

Marking the function as DECLSPEC_HOTPATCH to avoid reopening https://bugs.winehq.org/show_bug.cgi?id=36486 . Even with -fno-PIC, without DECLSPEC_HOTPATCH the generated code has a pushl at offset 7 that triggers the failure. Signed-off-by: Huw Davies <huw(a)codeweavers.com> --- dlls/kernel32/kernel32.spec | 4 ++-- dlls/kernel32/kernel_main.c | 32 -------------------------------- dlls/kernel32/path.c | 2 +- dlls/ntdll/ntdll.spec | 4 ++-- dlls/ntdll/ntdll_misc.h | 4 ++++ dlls/ntdll/time.c | 2 +- 6 files changed, 10 insertions(+), 38 deletions(-) diff --git a/dlls/kernel32/kernel32.spec b/dlls/kernel32/kernel32.spec index f887b1dc8c..691cc60d86 100644 --- a/dlls/kernel32/kernel32.spec +++ b/dlls/kernel32/kernel32.spec @@ -858,8 +858,8 @@ @ stdcall GetThreadPriorityBoost(long ptr) @ stdcall GetThreadSelectorEntry(long long ptr) @ stdcall GetThreadTimes(long ptr ptr ptr ptr) -@ stdcall GetTickCount() -@ stdcall -ret64 GetTickCount64() +@ stdcall GetTickCount() ntdll.NtGetTickCount +@ stdcall -ret64 GetTickCount64() ntdll.NtGetTickCount @ stdcall GetTimeFormatA(long long ptr str ptr long) @ stdcall GetTimeFormatEx(wstr long ptr wstr ptr long) @ stdcall GetTimeFormatW(long long ptr wstr ptr long) diff --git a/dlls/kernel32/kernel_main.c b/dlls/kernel32/kernel_main.c index d3420ece06..dfa66f0295 100644 --- a/dlls/kernel32/kernel_main.c +++ b/dlls/kernel32/kernel_main.c @@ -178,38 +178,6 @@ INT WINAPI MulDiv( INT nMultiplicand, INT nMultiplier, INT nDivisor) return ret; } - -/****************************************************************************** - * GetTickCount64 (KERNEL32.@) - */ -ULONGLONG WINAPI DECLSPEC_HOTPATCH GetTickCount64(void) -{ - LARGE_INTEGER counter, frequency; - - NtQueryPerformanceCounter( &counter, &frequency ); - return counter.QuadPart * 1000 / frequency.QuadPart; -} - - -/*********************************************************************** - * GetTickCount (KERNEL32.@) - * - * Get the number of milliseconds the system has been running. - * - * PARAMS - * None. - * - * RETURNS - * The current tick count. - * - * NOTES - * The value returned will wrap around every 2^32 milliseconds. - */ -DWORD WINAPI DECLSPEC_HOTPATCH GetTickCount(void) -{ - return GetTickCount64(); -} - /****************************************************************************** * GetSystemRegistryQuota (KERNEL32.@) */ diff --git a/dlls/kernel32/path.c b/dlls/kernel32/path.c index b8f49bd597..5fed28da0e 100644 --- a/dlls/kernel32/path.c +++ b/dlls/kernel32/path.c @@ -737,7 +737,7 @@ UINT WINAPI GetTempFileNameW( LPCWSTR path, LPCWSTR prefix, UINT unique, LPWSTR { /* get a "random" unique number and try to create the file */ HANDLE handle; - UINT num = GetTickCount() & 0xffff; + UINT num = NtGetTickCount() & 0xffff; static UINT last; /* avoid using the same name twice in a short interval */ diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec index aeb9735ba1..050ebc7641 100644 --- a/dlls/ntdll/ntdll.spec +++ b/dlls/ntdll/ntdll.spec @@ -194,7 +194,7 @@ @ stdcall NtGetCurrentProcessorNumber() # @ stub NtGetDevicePowerState @ stub NtGetPlugPlayEvent -@ stdcall NtGetTickCount() +@ stdcall -ret64 NtGetTickCount() get_tick_count64 @ stdcall NtGetWriteWatch(long long ptr long ptr ptr ptr) @ stdcall NtImpersonateAnonymousToken(long) @ stub NtImpersonateClientOfPort @@ -1142,7 +1142,7 @@ @ stdcall -private ZwGetCurrentProcessorNumber() NtGetCurrentProcessorNumber # @ stub ZwGetDevicePowerState @ stub ZwGetPlugPlayEvent -@ stdcall -private ZwGetTickCount() NtGetTickCount +@ stdcall -private -ret64 ZwGetTickCount() get_tick_count64 @ stdcall -private ZwGetWriteWatch(long long ptr long ptr ptr ptr) NtGetWriteWatch @ stdcall -private ZwImpersonateAnonymousToken(long) NtImpersonateAnonymousToken @ stub ZwImpersonateClientOfPort diff --git a/dlls/ntdll/ntdll_misc.h b/dlls/ntdll/ntdll_misc.h index 3463ebd38a..2d83f541bd 100644 --- a/dlls/ntdll/ntdll_misc.h +++ b/dlls/ntdll/ntdll_misc.h @@ -268,4 +268,8 @@ void WINAPI LdrInitializeThunk(CONTEXT*,void**,ULONG_PTR,ULONG_PTR); /* string functions */ int __cdecl NTDLL_tolower( int c ); int __cdecl _stricmp( LPCSTR str1, LPCSTR str2 ); + +/* time functions */ +ULONGLONG WINAPI get_tick_count64( void ); +#define NtGetTickCount get_tick_count64 #endif diff --git a/dlls/ntdll/time.c b/dlls/ntdll/time.c index 20de627c28..41e456398e 100644 --- a/dlls/ntdll/time.c +++ b/dlls/ntdll/time.c @@ -557,7 +557,7 @@ NTSTATUS WINAPI NtQueryPerformanceCounter( LARGE_INTEGER *counter, LARGE_INTEGER * NtGetTickCount (NTDLL.@) * ZwGetTickCount (NTDLL.@) */ -ULONG WINAPI NtGetTickCount(void) +ULONGLONG WINAPI DECLSPEC_HOTPATCH get_tick_count64(void) { return monotonic_counter() / TICKSPERMSEC; } -- 2.17.1

2 1

[PATCH] oledb32: Remove duplicate WINAPI.
by Andrey Gusev May 28, 2019

May 28, 2019

Signed-off-by: Andrey Gusev <andrey.goosev(a)gmail.com> --- dlls/oledb32/errorinfo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/oledb32/errorinfo.c b/dlls/oledb32/errorinfo.c index f1c9cd17ef..62491673bc 100644 --- a/dlls/oledb32/errorinfo.c +++ b/dlls/oledb32/errorinfo.c @@ -219,13 +219,13 @@ static HRESULT WINAPI errorrec_QueryInterface(IErrorRecords *iface, REFIID riid, return IErrorInfo_QueryInterface(&This->IErrorInfo_iface, riid, ppvObject); } -static ULONG WINAPI WINAPI errorrec_AddRef(IErrorRecords *iface) +static ULONG WINAPI errorrec_AddRef(IErrorRecords *iface) { errorrecords *This = impl_from_IErrorRecords(iface); return IErrorInfo_AddRef(&This->IErrorInfo_iface); } -static ULONG WINAPI WINAPI errorrec_Release(IErrorRecords *iface) +static ULONG WINAPI errorrec_Release(IErrorRecords *iface) { errorrecords *This = impl_from_IErrorRecords(iface); return IErrorInfo_Release(&This->IErrorInfo_iface); -- 2.21.0

1 0

[PATCH] winemac.drv: use NI_COMPOSITIONSTR/CPS_CANCEL when composition string is empty
by Aric Stewart May 28, 2019

May 28, 2019

This sends the expected WM_IME_ENDCOMPOSITION message Signed-off-by: Aric Stewart <aric(a)codeweavers.com> --- dlls/winemac.drv/ime.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)

2 1

[PATCH 3/3] mshtml: Rewrite IHTMLLocation::get_pathname on top of IUri.
by Jacek Caban May 28, 2019

May 28, 2019

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=37279 Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/mshtml/htmllocation.c | 23 +++++++++++++---------- dlls/mshtml/tests/elements.js | 17 +++++++++++++++++ dlls/mshtml/tests/htmllocation.c | 3 +++ dlls/mshtml/tests/script.c | 6 ++++++ 4 files changed, 39 insertions(+), 10 deletions(-)

1 0

[PATCH 2/3] mshtml/tests: Include leading path slash in location test array.
by Jacek Caban May 28, 2019

May 28, 2019

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/mshtml/tests/htmllocation.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)

1 0

[PATCH 1/3] mshtml/tests: Fix tests on some recent IE versions.
by Jacek Caban May 28, 2019

May 28, 2019

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/mshtml/tests/script.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)

1 0

[PATCH] ext-ms-win-ntuser-windowclass-l1-1-0: Update spec file.
by Andrey Gusev May 28, 2019

May 28, 2019

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47280 Signed-off-by: Andrey Gusev <andrey.goosev(a)gmail.com> --- .../ext-ms-win-ntuser-windowclass-l1-1-0.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dlls/ext-ms-win-ntuser-windowclass-l1-1-0/ext-ms-win-ntuser-windowclass-l1-1-0.spec b/dlls/ext-ms-win-ntuser-windowclass-l1-1-0/ext-ms-win-ntuser-windowclass-l1-1-0.spec index 8b2ab2b260..ad8dafe9f7 100644 --- a/dlls/ext-ms-win-ntuser-windowclass-l1-1-0/ext-ms-win-ntuser-windowclass-l1-1-0.spec +++ b/dlls/ext-ms-win-ntuser-windowclass-l1-1-0/ext-ms-win-ntuser-windowclass-l1-1-0.spec @@ -5,11 +5,13 @@ @ stdcall GetClassNameA(long ptr long) user32.GetClassNameA @ stdcall GetClassNameW(long ptr long) user32.GetClassNameW @ stdcall GetWindowLongA(long long) user32.GetWindowLongA +@ stdcall -arch=win64 GetWindowLongPtrW(long long) user32.GetWindowLongPtrW @ stdcall GetWindowLongW(long long) user32.GetWindowLongW @ stdcall RegisterClassA(ptr) user32.RegisterClassA @ stdcall RegisterClassExW(ptr) user32.RegisterClassExW @ stdcall RegisterClassW(ptr) user32.RegisterClassW @ stdcall SetWindowLongA(long long long) user32.SetWindowLongA +@ stdcall -arch=win64 SetWindowLongPtrW(long long long) user32.SetWindowLongPtrW @ stdcall SetWindowLongW(long long long) user32.SetWindowLongW @ stdcall UnregisterClassA(str long) user32.UnregisterClassA @ stdcall UnregisterClassW(wstr long) user32.UnregisterClassW -- 2.21.0

1 0

[PATCH] xinput: Fix rumble amount value rounding
by Rémi Bernon May 28, 2019

May 28, 2019

XINPUT_VIBRATION structure documentation says that wLeftMotorSpeed and wRightMotorSpeed can range from 0 to 65535. The values were incorrectly divided by 255 in HID_set_state, which made the value range overflow one byte. Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/xinput1_3/hid.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dlls/xinput1_3/hid.c b/dlls/xinput1_3/hid.c index 34e4e51285c..dc5601cb6a1 100644 --- a/dlls/xinput1_3/hid.c +++ b/dlls/xinput1_3/hid.c @@ -469,8 +469,8 @@ DWORD HID_set_state(xinput_controller* device, XINPUT_VIBRATION* state) report.report = 0; report.pad1[0] = 0x8; report.pad1[1] = 0x0; - report.left = (BYTE)(state->wLeftMotorSpeed / 255); - report.right = (BYTE)(state->wRightMotorSpeed / 255); + report.left = (BYTE)(state->wLeftMotorSpeed / 256); + report.right = (BYTE)(state->wRightMotorSpeed / 256); memset(&report.pad2, 0, sizeof(report.pad2)); EnterCriticalSection(&private->crit); -- 2.20.1

1 0

[PATCH v2 1/2] winepulse.drv: Adjust the buffer volume before sending it to PulseAudio
by Gabriel Ivăncescu May 28, 2019

May 28, 2019

Only fixes the PulseAudio driver for the first bug, not ALSA. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=38182 Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=46450 Signed-off-by: Gabriel Ivăncescu <gabrielopcode(a)gmail.com> --- v2: Use ss.channels instead of the session's channel_count. This fixes the discrepancy and the buffer overflow (the session seems to only grow, so at some point it was probably stereo). The Windows API here works with frames, so thankfully there's no issue with partial frames or the like (as I wrongly suspected) which won't require a lot of convoluted tracking, i.e. ReleaseBuffer multiplies the frame size by number of samples to get the bytes arg. Now it also matches the same thing used in winecoreaudio.drv so it should be correct. dlls/winepulse.drv/mmdevdrv.c | 154 ++++++++++++++++++++++++++++++---- 1 file changed, 138 insertions(+), 16 deletions(-) diff --git a/dlls/winepulse.drv/mmdevdrv.c b/dlls/winepulse.drv/mmdevdrv.c index 8d57f1a..38d5130 100644 --- a/dlls/winepulse.drv/mmdevdrv.c +++ b/dlls/winepulse.drv/mmdevdrv.c @@ -621,6 +621,135 @@ static void silence_buffer(pa_sample_format_t format, BYTE *buffer, UINT32 bytes memset(buffer, format == PA_SAMPLE_U8 ? 0x80 : 0, bytes); } +static void pulse_free_noop(void *buf) +{ +} + +enum write_buffer_flags +{ + WINEPULSE_WRITE_NOFREE = 0x01, + WINEPULSE_WRITE_SILENT = 0x02 +}; + +static int write_buffer(const ACImpl *This, BYTE *buffer, UINT32 bytes, + enum write_buffer_flags flags) +{ + float vol[PA_CHANNELS_MAX]; + BOOL adjust = FALSE; + UINT32 i, channels; + BYTE *end; + + if (!bytes) return 0; + if (This->session->mute || (flags & WINEPULSE_WRITE_SILENT)) + { + silence_buffer(This->ss.format, buffer, bytes); + goto write; + } + + /* Adjust the buffer based on the volume for each channel */ + channels = This->ss.channels; + for (i = 0; i < channels; i++) + { + vol[i] = This->vol[i] * This->session->master_vol * This->session->channel_vols[i]; + adjust |= vol[i] != 1.0f; + } + if (!adjust) goto write; + + end = buffer + bytes; + switch (This->ss.format) + { +#ifndef WORDS_BIGENDIAN +#define PROCESS_BUFFER(type) do \ +{ \ + type *p = (type*)buffer; \ + do \ + { \ + for (i = 0; i < channels; i++) \ + p[i] = p[i] * vol[i]; \ + p += i; \ + } while ((BYTE*)p != end); \ +} while (0); + case PA_SAMPLE_S16LE: + PROCESS_BUFFER(INT16); + break; + case PA_SAMPLE_S32LE: + PROCESS_BUFFER(INT32); + break; + case PA_SAMPLE_FLOAT32LE: + PROCESS_BUFFER(float); + break; +#undef PROCESS_BUFFER + case PA_SAMPLE_S24_32LE: + { + UINT32 *p = (UINT32*)buffer; + do + { + for (i = 0; i < channels; i++) + { + p[i] = (INT32)((INT32)(p[i] << 8) * vol[i]); + p[i] >>= 8; + } + p += i; + } while ((BYTE*)p != end); + break; + } + case PA_SAMPLE_S24LE: + { + /* do it 12 bytes at a time until it is no longer possible */ + UINT32 *q = (UINT32*)buffer; + BYTE *p; + + i = 0; + while (end - (BYTE*)q >= 12) + { + UINT32 v[4], k; + v[0] = q[0] << 8; + v[1] = q[1] << 16 | (q[0] >> 16 & ~0xff); + v[2] = q[2] << 24 | (q[1] >> 8 & ~0xff); + v[3] = q[2] & ~0xff; + for (k = 0; k < 4; k++) + { + v[k] = (INT32)((INT32)v[k] * vol[i]); + if (++i == channels) i = 0; + } + *q++ = v[0] >> 8 | (v[1] & ~0xff) << 16; + *q++ = v[1] >> 16 | (v[2] & ~0xff) << 8; + *q++ = v[2] >> 24 | (v[3] & ~0xff); + } + p = (BYTE*)q; + while (p != end) + { + UINT32 v = (INT32)((INT32)(p[0] << 8 | p[1] << 16 | p[2] << 24) * vol[i]); + *p++ = v >> 8 & 0xff; + *p++ = v >> 16 & 0xff; + *p++ = v >> 24; + if (++i == channels) i = 0; + } + break; + } +#endif + case PA_SAMPLE_U8: + { + UINT8 *p = (UINT8*)buffer; + do + { + for (i = 0; i < channels; i++) + p[i] = (int)((p[i] - 128) * vol[i]) + 128; + p += i; + } while ((BYTE*)p != end); + break; + } + default: + TRACE("Unhandled format %i, not adjusting volume.\n", This->ss.format); + break; + } + +write: + return pa_stream_write(This->stream, buffer, bytes, + (flags & WINEPULSE_WRITE_NOFREE) ? pulse_free_noop : NULL, + 0, PA_SEEK_RELATIVE); +} + static void dump_attr(const pa_buffer_attr *attr) { TRACE("maxlength: %u\n", attr->maxlength); TRACE("minreq: %u\n", attr->minreq); @@ -681,7 +810,7 @@ static void pulse_wr_callback(pa_stream *s, size_t bytes, void *userdata) if(This->lcl_offs_bytes + bytes > This->bufsize_bytes){ to_write = This->bufsize_bytes - This->lcl_offs_bytes; TRACE("writing small chunk of %u bytes\n", to_write); - pa_stream_write(This->stream, buf, to_write, NULL, 0, PA_SEEK_RELATIVE); + write_buffer(This, buf, to_write, 0); This->held_bytes -= to_write; to_write = bytes - to_write; This->lcl_offs_bytes = 0; @@ -690,7 +819,7 @@ static void pulse_wr_callback(pa_stream *s, size_t bytes, void *userdata) to_write = bytes; TRACE("writing main chunk of %u bytes\n", to_write); - pa_stream_write(This->stream, buf, to_write, NULL, 0, PA_SEEK_RELATIVE); + write_buffer(This, buf, to_write, 0); This->lcl_offs_bytes += to_write; This->lcl_offs_bytes %= This->bufsize_bytes; This->held_bytes -= to_write; @@ -2126,10 +2255,6 @@ static void pulse_wrap_buffer(ACImpl *This, BYTE *buffer, UINT32 written_bytes) } } -static void pulse_free_noop(void *buf) -{ -} - static HRESULT WINAPI AudioRenderClient_ReleaseBuffer( IAudioRenderClient *iface, UINT32 written_frames, DWORD flags) { @@ -2181,7 +2306,7 @@ static HRESULT WINAPI AudioRenderClient_ReleaseBuffer( TRACE("pre-writing %u bytes\n", to_write); - e = pa_stream_write(This->stream, buffer, to_write, NULL, 0, PA_SEEK_RELATIVE); + e = write_buffer(This, buffer, to_write, 0); if(e) ERR("pa_stream_write failed: 0x%x\n", e); @@ -2191,15 +2316,12 @@ static HRESULT WINAPI AudioRenderClient_ReleaseBuffer( } }else{ - if (This->locked_ptr) { - if (flags & AUDCLNT_BUFFERFLAGS_SILENT) - silence_buffer(This->ss.format, This->locked_ptr, written_bytes); - pa_stream_write(This->stream, This->locked_ptr, written_bytes, NULL, 0, PA_SEEK_RELATIVE); - } else { - if (flags & AUDCLNT_BUFFERFLAGS_SILENT) - silence_buffer(This->ss.format, This->tmp_buffer, written_bytes); - pa_stream_write(This->stream, This->tmp_buffer, written_bytes, pulse_free_noop, 0, PA_SEEK_RELATIVE); - } + enum write_buffer_flags wr_flags = 0; + + if (flags & AUDCLNT_BUFFERFLAGS_SILENT) wr_flags |= WINEPULSE_WRITE_SILENT; + if (!This->locked_ptr) wr_flags |= WINEPULSE_WRITE_NOFREE; + + write_buffer(This, This->locked_ptr ? This->locked_ptr : This->tmp_buffer, written_bytes, wr_flags); This->pad += written_bytes; } -- 2.21.0

2 3