June 2022 - Wine-Devel - list.winehq.org

[PATCH 3/5] d2d1: Implement property parsing for RegisterEffectFromStream().

by Ziqing Hui

Signed-off-by: Ziqing Hui <zhui(a)codeweavers.com> --- dlls/d2d1/d2d1_private.h | 12 +++ dlls/d2d1/factory.c | 155 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 164 insertions(+), 3 deletions(-) diff --git a/dlls/d2d1/d2d1_private.h b/dlls/d2d1/d2d1_private.h index cc625ff5719..07f07c3a087 100644 --- a/dlls/d2d1/d2d1_private.h +++ b/dlls/d2d1/d2d1_private.h @@ -603,12 +603,24 @@ struct d2d_effect_context void d2d_effect_context_init(struct d2d_effect_context *effect_context, struct d2d_device_context *device_context) DECLSPEC_HIDDEN; +struct d2d_effect_property +{ + WCHAR *name; + D2D1_PROPERTY_TYPE type; + PD2D1_PROPERTY_SET_FUNCTION set_function; + PD2D1_PROPERTY_GET_FUNCTION get_function; +}; + struct d2d_effect_info { const CLSID *clsid; UINT32 default_input_count; UINT32 min_inputs; UINT32 max_inputs; + WCHAR *display_name; + WCHAR *author; + WCHAR *category; + WCHAR *description; }; struct d2d_effect diff --git a/dlls/d2d1/factory.c b/dlls/d2d1/factory.c index e8aa1fab012..b3b65b0cb92 100644 --- a/dlls/d2d1/factory.c +++ b/dlls/d2d1/factory.c @@ -36,6 +36,10 @@ struct d2d_effect_reg struct d2d_effect_info *info; + struct d2d_effect_property *properties; + size_t property_size; + size_t property_count; + struct list entry; }; @@ -67,10 +71,24 @@ static inline struct d2d_factory *impl_from_ID2D1Multithread(ID2D1Multithread *i static void d2d_effect_reg_cleanup(struct d2d_effect_reg *reg) { + size_t i; + if (!reg) return; - heap_free(reg->info); + if (reg->info) + { + heap_free(reg->info->display_name); + heap_free(reg->info->author); + heap_free(reg->info->category); + heap_free(reg->info->description); + heap_free(reg->info); + } + + for (i = 0; i < reg->property_count; ++i) + heap_free(reg->properties[i].name); + heap_free(reg->properties); + heap_free(reg); } @@ -590,6 +608,110 @@ static HRESULT STDMETHODCALLTYPE d2d_factory_CreateGdiMetafile(ID2D1Factory3 *if return E_NOTIMPL; } +static HRESULT heap_get_attribute(IXmlReader *xml_reader, const WCHAR *name, WCHAR **ptr) +{ + const WCHAR *value; + + if (IXmlReader_MoveToAttributeByName(xml_reader, name, NULL) != S_OK) + return E_INVALIDARG; + if (IXmlReader_GetValue(xml_reader, &value, NULL) != S_OK) + return E_INVALIDARG; + if (!(*ptr = heap_strdupW(value))) + return E_OUTOFMEMORY; + return S_OK; +} + +static D2D1_PROPERTY_TYPE str_to_property_type(const WCHAR *str) +{ + unsigned int i; + + static const WCHAR *type_str[] = + { + L"", L"string", L"bool", L"uint32", L"int32", L"float", L"vector2", L"vector3", + L"vector4", L"blob", L"iunknown", L"enum", L"array", L"clsid", L"matrix3x2", + L"matrix4x3", L"matrix4x4", L"matrix5x4", L"colorcontext", + }; + + for (i = 1; i < ARRAY_SIZE(type_str); ++i) + { + if (!wcscmp(str, type_str[i])) + return i; + } + + return D2D1_PROPERTY_TYPE_UNKNOWN; +} + +static HRESULT parse_property(IXmlReader *xml_reader, struct d2d_effect_reg *reg) +{ + struct d2d_effect_property *entry; + D2D1_PROPERTY_TYPE property_type; + WCHAR **ptr = NULL, *name = NULL; + const WCHAR *type; + unsigned int i; + HRESULT hr; + + /* get property name and type */ + if (FAILED(hr = heap_get_attribute(xml_reader, L"name", &name))) + goto done; + if ((hr = IXmlReader_MoveToAttributeByName(xml_reader, L"type", NULL)) != S_OK) + goto done; + if ((hr = IXmlReader_GetValue(xml_reader, &type, NULL)) != S_OK) + goto done; + property_type = str_to_property_type(type); + if (property_type == D2D1_PROPERTY_TYPE_UNKNOWN) + { + hr = E_INVALIDARG; + goto done; + } + + /* is system property */ + if (!wcscmp(name, L"DisplayName")) + ptr = &reg->info->display_name; + else if(!wcscmp(name, L"Author")) + ptr = &reg->info->author; + else if(!wcscmp(name, L"Category")) + ptr = &reg->info->category; + else if(!wcscmp(name, L"Description")) + ptr = &reg->info->description; + if (ptr) + { + heap_free(name); + if (*ptr || property_type != D2D1_PROPERTY_TYPE_STRING) + return E_INVALIDARG; + if (FAILED(heap_get_attribute(xml_reader, L"value", ptr))) + { + if (!(*ptr = heap_strdupW(L""))) + hr = E_OUTOFMEMORY; + } + return hr; + } + + /* is custom property */ + for (i = 0; i < reg->property_count; ++i) + { + if (!wcscmp(name, reg->properties[i].name)) + { + hr = E_INVALIDARG; + goto done; + } + } + if (!d2d_array_reserve((void **)&reg->properties, &reg->property_size, reg->property_count + 1, sizeof(*reg->properties))) + { + ERR("Failed to resize properties array.\n"); + goto done; + } + entry = &reg->properties[reg->property_count++]; + entry->name = name; + entry->type = property_type; + entry->get_function = NULL; + entry->set_function = NULL; + +done: + if (hr != S_OK) + heap_free(name); + return hr; +} + static HRESULT parse_effect_xml(IStream *property_xml, struct d2d_effect_reg *reg) { unsigned int i, len, depth, input_count = 0; @@ -632,7 +754,8 @@ static HRESULT parse_effect_xml(IStream *property_xml, struct d2d_effect_reg *re if (!wcscmp(node_name[depth - 1], L"Effect") && !wcscmp(node_name[depth], L"Property")) { - FIXME("Property is ignored.\n"); + if (FAILED(hr = parse_property(xml_reader, reg))) + goto done; } break; case 2: @@ -644,7 +767,7 @@ static HRESULT parse_effect_xml(IStream *property_xml, struct d2d_effect_reg *re else if (!wcscmp(node_name[depth - 1], L"Property") && !wcscmp(node_name[depth], L"Property")) { - FIXME("Sub property is ignored.\n"); + FIXME("SubProperty is ignored.\n"); } break; default: @@ -652,6 +775,12 @@ static HRESULT parse_effect_xml(IStream *property_xml, struct d2d_effect_reg *re } } + if (!reg->info->display_name || !reg->info->author || !reg->info->category || !reg->info->description) + { + hr = E_INVALIDARG; + goto done; + } + reg->info->default_input_count = input_count; reg->info->min_inputs = input_count; reg->info->max_inputs = input_count; @@ -669,6 +798,7 @@ static HRESULT STDMETHODCALLTYPE d2d_factory_RegisterEffectFromStream(ID2D1Facto { struct d2d_factory *factory = impl_from_ID2D1Factory3(iface); struct d2d_effect_reg *iter, *entry = NULL; + unsigned int i, j; HRESULT hr; TRACE("iface %p, effect_id %s, property_xml %p, bindings %p, binding_count %u, effect_factory %p.\n", @@ -692,6 +822,25 @@ static HRESULT STDMETHODCALLTYPE d2d_factory_RegisterEffectFromStream(ID2D1Facto if (FAILED(hr = parse_effect_xml(property_xml, entry))) goto done; + /* bind getter and setter to properties */ + for (i = 0; i < binding_count; ++i) + { + for (j = 0; j < entry->property_count; ++j) + { + if (!wcscmp(bindings[i].propertyName, entry->properties[j].name)) + { + entry->properties[j].get_function = bindings[i].getFunction; + entry->properties[j].set_function = bindings[i].setFunction; + break; + } + } + if (j > entry->property_count) + { + hr = D2DERR_INVALID_PROPERTY; + goto done; + } + } + entry->count = 1; entry->info->clsid = effect_id; entry->factory = effect_factory; -- 2.25.1

June 6, 2022

[PATCH 2/5] d2d1: Partially implement RegisterEffectFromStream().

by Ziqing Hui

Signed-off-by: Ziqing Hui <zhui(a)codeweavers.com> --- List is used here rather than array. Because we will remove node in UnregisterEffect(). dlls/d2d1/Makefile.in | 2 +- dlls/d2d1/d2d1_private.h | 16 +++++ dlls/d2d1/factory.c | 134 ++++++++++++++++++++++++++++++++++++++- 3 files changed, 149 insertions(+), 3 deletions(-) diff --git a/dlls/d2d1/Makefile.in b/dlls/d2d1/Makefile.in index 413571338ba..2456c63c336 100644 --- a/dlls/d2d1/Makefile.in +++ b/dlls/d2d1/Makefile.in @@ -1,6 +1,6 @@ MODULE = d2d1.dll IMPORTLIB = d2d1 -IMPORTS = d3d10_1 dxguid uuid gdi32 user32 advapi32 +IMPORTS = d3d10_1 dxguid uuid gdi32 user32 advapi32 ole32 xmllite DELAYIMPORTS = dwrite C_SRCS = \ diff --git a/dlls/d2d1/d2d1_private.h b/dlls/d2d1/d2d1_private.h index efc9247a822..cc625ff5719 100644 --- a/dlls/d2d1/d2d1_private.h +++ b/dlls/d2d1/d2d1_private.h @@ -768,4 +768,20 @@ static inline const char *debug_d2d_ellipse(const D2D1_ELLIPSE *ellipse) ellipse->point.x, ellipse->point.y, ellipse->radiusX, ellipse->radiusY); } +static inline WCHAR *heap_strdupW(const WCHAR *str) +{ + WCHAR *ret = NULL; + size_t size; + + if(!str) + return ret; + + size = (wcslen(str) + 1) * sizeof(*str); + if(!(ret = heap_alloc(size))) + return ret; + memcpy(ret, str, size); + + return ret; +} + #endif /* __WINE_D2D1_PRIVATE_H */ diff --git a/dlls/d2d1/factory.c b/dlls/d2d1/factory.c index 01dac8051c0..e8aa1fab012 100644 --- a/dlls/d2d1/factory.c +++ b/dlls/d2d1/factory.c @@ -18,6 +18,8 @@ #define D2D1_INIT_GUID #include "d2d1_private.h" +#include "xmllite.h" +#include "wine/list.h" WINE_DECLARE_DEBUG_CHANNEL(winediag); WINE_DEFAULT_DEBUG_CHANNEL(d2d); @@ -27,6 +29,16 @@ struct d2d_settings d2d_settings = ~0u, /* No ID2D1Factory version limit by default. */ }; +struct d2d_effect_reg +{ + PD2D1_EFFECT_FACTORY factory; + UINT32 count; + + struct d2d_effect_info *info; + + struct list entry; +}; + struct d2d_factory { ID2D1Factory3 ID2D1Factory3_iface; @@ -39,6 +51,8 @@ struct d2d_factory float dpi_y; CRITICAL_SECTION cs; + + struct list effect_regs; }; static inline struct d2d_factory *impl_from_ID2D1Factory3(ID2D1Factory3 *iface) @@ -51,6 +65,15 @@ static inline struct d2d_factory *impl_from_ID2D1Multithread(ID2D1Multithread *i return CONTAINING_RECORD(iface, struct d2d_factory, ID2D1Multithread_iface); } +static void d2d_effect_reg_cleanup(struct d2d_effect_reg *reg) +{ + if (!reg) + return; + + heap_free(reg->info); + heap_free(reg); +} + static HRESULT d2d_factory_reload_sysmetrics(struct d2d_factory *factory) { HDC hdc; @@ -112,6 +135,7 @@ static ULONG STDMETHODCALLTYPE d2d_factory_Release(ID2D1Factory3 *iface) { struct d2d_factory *factory = impl_from_ID2D1Factory3(iface); ULONG refcount = InterlockedDecrement(&factory->refcount); + struct d2d_effect_reg *iter, *iter2; TRACE("%p decreasing refcount to %lu.\n", iface, refcount); @@ -120,6 +144,8 @@ static ULONG STDMETHODCALLTYPE d2d_factory_Release(ID2D1Factory3 *iface) if (factory->device) ID3D10Device1_Release(factory->device); DeleteCriticalSection(&factory->cs); + LIST_FOR_EACH_ENTRY_SAFE(iter, iter2, &factory->effect_regs, struct d2d_effect_reg, entry) + d2d_effect_reg_cleanup(iter); heap_free(factory); } @@ -564,14 +590,117 @@ static HRESULT STDMETHODCALLTYPE d2d_factory_CreateGdiMetafile(ID2D1Factory3 *if return E_NOTIMPL; } +static HRESULT parse_effect_xml(IStream *property_xml, struct d2d_effect_reg *reg) +{ + unsigned int i, len, depth, input_count = 0; + IXmlReader *xml_reader; + WCHAR *node_name[3]; + const WCHAR *value; + XmlNodeType type; + HRESULT hr; + + if (FAILED(hr = CreateXmlReader(&IID_IXmlReader, (void **)&xml_reader, NULL))) + return hr; + if (FAILED(hr = IXmlReader_SetInput(xml_reader, (IUnknown *)property_xml))) + goto done; + + memset(node_name, 0, sizeof(node_name)); + while (IXmlReader_Read(xml_reader, &type) == S_OK) + { + if (FAILED(hr = IXmlReader_GetDepth(xml_reader, &depth))) + goto done; + if (depth >= 3) + continue; + if (FAILED(hr = IXmlReader_GetLocalName(xml_reader, &value, &len))) + goto done; + if (node_name[depth] && wcslen(node_name[depth]) <= len) + { + wcscpy(node_name[depth], value); + } + else + { + heap_free(node_name[depth]); + node_name[depth] = heap_strdupW(value); + } + + if (type != XmlNodeType_Element) + continue; + + switch (depth) + { + case 1: + if (!wcscmp(node_name[depth - 1], L"Effect") + && !wcscmp(node_name[depth], L"Property")) + { + FIXME("Property is ignored.\n"); + } + break; + case 2: + if (!wcscmp(node_name[depth - 1], L"Inputs") + && !wcscmp(node_name[depth], L"Input")) + { + ++input_count; + } + else if (!wcscmp(node_name[depth - 1], L"Property") + && !wcscmp(node_name[depth], L"Property")) + { + FIXME("Sub property is ignored.\n"); + } + break; + default: + break; + } + } + + reg->info->default_input_count = input_count; + reg->info->min_inputs = input_count; + reg->info->max_inputs = input_count; + +done: + for (i = 0; i < ARRAY_SIZE(node_name); ++i) + heap_free(node_name[i]); + IXmlReader_Release(xml_reader); + return hr; +} + static HRESULT STDMETHODCALLTYPE d2d_factory_RegisterEffectFromStream(ID2D1Factory3 *iface, REFCLSID effect_id, IStream *property_xml, const D2D1_PROPERTY_BINDING *bindings, UINT32 binding_count, PD2D1_EFFECT_FACTORY effect_factory) { - FIXME("iface %p, effect_id %s, property_xml %p, bindings %p, binding_count %u, effect_factory %p stub!\n", + struct d2d_factory *factory = impl_from_ID2D1Factory3(iface); + struct d2d_effect_reg *iter, *entry = NULL; + HRESULT hr; + + TRACE("iface %p, effect_id %s, property_xml %p, bindings %p, binding_count %u, effect_factory %p.\n", iface, debugstr_guid(effect_id), property_xml, bindings, binding_count, effect_factory); - return E_NOTIMPL; + LIST_FOR_EACH_ENTRY(iter, &factory->effect_regs, struct d2d_effect_reg, entry) + { + if (IsEqualGUID(effect_id, iter->info->clsid)) + { + ++iter->count; + return S_OK; + } + } + + if (!(entry = heap_alloc_zero(sizeof(*entry))) || !(entry->info = heap_alloc_zero(sizeof(*entry->info)))) + { + hr = E_OUTOFMEMORY; + goto done; + } + + if (FAILED(hr = parse_effect_xml(property_xml, entry))) + goto done; + + entry->count = 1; + entry->info->clsid = effect_id; + entry->factory = effect_factory; + list_add_tail(&factory->effect_regs, &entry->entry); + +done: + if (hr != S_OK) + d2d_effect_reg_cleanup(entry); + return hr; } static HRESULT STDMETHODCALLTYPE d2d_factory_RegisterEffectFromString(ID2D1Factory3 *iface, @@ -743,6 +872,7 @@ static void d2d_factory_init(struct d2d_factory *factory, D2D1_FACTORY_TYPE fact factory->refcount = 1; d2d_factory_reload_sysmetrics(factory); InitializeCriticalSection(&factory->cs); + list_init(&factory->effect_regs); } HRESULT WINAPI D2D1CreateFactory(D2D1_FACTORY_TYPE factory_type, REFIID iid, -- 2.25.1

June 6, 2022

[PATCH 1/5] d2d1/tests: Add more test xml.

by Ziqing Hui

Signed-off-by: Ziqing Hui <zhui(a)codeweavers.com> --- dlls/d2d1/tests/d2d1.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/dlls/d2d1/tests/d2d1.c b/dlls/d2d1/tests/d2d1.c index bc662b4f8ae..3e385b2b05f 100644 --- a/dlls/d2d1/tests/d2d1.c +++ b/dlls/d2d1/tests/d2d1.c @@ -170,6 +170,29 @@ L"<?xml version='1.0'?> \ </Effect> \ "; +static const WCHAR *effect_xml_wrong_type = +L"<?xml version='1.0'?> \ + <Effect> \ + <Property name='DisplayName' type='string' value='TestEffect'/> \ + <Property name='Author' type='uint32' value='32'/> \ + <Property name='Category' type='string' value='Test'/> \ + <Property name='Description' type='string' value='Test effect.'/> \ + <Inputs/> \ + </Effect> \ +"; + +static const WCHAR *effect_xml_duplicate_property = +L"<?xml version='1.0'?> \ + <Effect> \ + <Property name='DisplayName' type='string'/> \ + <Property name='Author' type='string'/> \ + <Property name='Category' type='string'/> \ + <Property name='Description' type='string'/> \ + <Property name='Description' type='string'/> \ + <Inputs/> \ + </Effect> \ +"; + static const DWORD test_vs[] = { #if 0 @@ -10615,6 +10638,8 @@ static void test_effect_register(BOOL d3d11) {effect_xml_without_category, E_INVALIDARG}, {effect_xml_without_description, E_INVALIDARG}, {effect_xml_without_type, E_INVALIDARG}, + {effect_xml_wrong_type, E_INVALIDARG}, + {effect_xml_duplicate_property, E_INVALIDARG}, }; const D2D1_PROPERTY_BINDING binding[] = -- 2.25.1

June 6, 2022

Re: [PATCH 0/6] MR179: winegstreamer: Use the wg_sample structure to wrap and read media samples. - closed

by Rémi Bernon

This merge request was closed by Rémi Bernon. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/179

June 6, 2022

Re: [PATCH v2 0/9] MR180: misc: Fixes and workarounds for UAF warnings. (GCC12)

by Rémi Bernon

On Mon Jun 6 06:09:19 2022 +0000, Esme wrote: > Normally I would sign-off the mscoree patch but I don't know how to do > that here. You're expected to approve the MR if you're okay with the changes, but I see you're not in the reviewers so I think you need to first request project access on https://gitlab.winehq.org/wine/wine to get the permission to review. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/180#note_1598

June 6, 2022

[PATCH v2 9/9] server: Avoid using pointer value after realloc.

by Rémi Bernon

From: Rémi Bernon <rbernon(a)codeweavers.com> Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- server/queue.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/server/queue.c b/server/queue.c index d79add56fba..9c5469292fe 100644 --- a/server/queue.c +++ b/server/queue.c @@ -3350,7 +3350,7 @@ DECL_HANDLER(get_rawinput_buffer) struct thread_input *input = current->queue->input; data_size_t size = 0, next_size = 0; struct list *ptr; - char *buf, *cur, *tmp; + char *buf, *cur; int count = 0, buf_size = 16 * sizeof(struct hardware_msg_data); if (!req->buffer_size) buf = NULL; @@ -3372,14 +3372,14 @@ DECL_HANDLER(get_rawinput_buffer) if (cur + data->size > buf + get_reply_max_size()) break; if (cur + data->size > buf + buf_size) { + size_t pos = cur - buf; buf_size += buf_size / 2 + extra_size; - if (!(tmp = realloc( buf, buf_size ))) + if (!(buf = realloc( buf, buf_size ))) { set_error( STATUS_NO_MEMORY ); return; } - cur = tmp + (cur - buf); - buf = tmp; + cur = buf + pos; } memcpy( cur, data, data->size ); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/180

June 6, 2022

[PATCH v2 8/9] d3drm: Avoid using pointer value after free.

by Rémi Bernon

From: Rémi Bernon <rbernon(a)codeweavers.com> Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/d3drm/d3drm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/d3drm/d3drm.c b/dlls/d3drm/d3drm.c index 864323053f3..cc83ae6d1f3 100644 --- a/dlls/d3drm/d3drm.c +++ b/dlls/d3drm/d3drm.c @@ -210,8 +210,8 @@ static inline struct d3drm *impl_from_IDirect3DRM3(IDirect3DRM3 *iface) static void d3drm_destroy(struct d3drm *d3drm) { - heap_free(d3drm); TRACE("d3drm object %p is being destroyed.\n", d3drm); + heap_free(d3drm); } static HRESULT WINAPI d3drm1_QueryInterface(IDirect3DRM *iface, REFIID riid, void **out) -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/180

June 6, 2022

[PATCH v2 7/9] dsound: Avoid using pointer value after free.

by Rémi Bernon

From: Rémi Bernon <rbernon(a)codeweavers.com> Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/dsound/buffer.c | 4 ++-- dlls/dsound/capture.c | 6 +++--- dlls/dsound/dsound.c | 4 ++-- dlls/dsound/duplex.c | 2 +- dlls/dsound/propset.c | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/dlls/dsound/buffer.c b/dlls/dsound/buffer.c index eb87479b7df..799b64e0e38 100644 --- a/dlls/dsound/buffer.c +++ b/dlls/dsound/buffer.c @@ -1192,9 +1192,9 @@ void secondarybuffer_destroy(IDirectSoundBufferImpl *This) HeapFree(GetProcessHeap(), 0, This->filters); } - HeapFree(GetProcessHeap(), 0, This); - TRACE("(%p) released\n", This); + + HeapFree(GetProcessHeap(), 0, This); } BOOL secondarybuffer_is_audible(IDirectSoundBufferImpl *This) diff --git a/dlls/dsound/capture.c b/dlls/dsound/capture.c index a00748d95bf..2c3dd83e86d 100644 --- a/dlls/dsound/capture.c +++ b/dlls/dsound/capture.c @@ -109,8 +109,8 @@ static void capturebuffer_destroy(IDirectSoundCaptureBufferImpl *This) This->device->capture_buffer = NULL; HeapFree(GetProcessHeap(), 0, This->notifies); - HeapFree(GetProcessHeap(), 0, This); TRACE("(%p) released\n", This); + HeapFree(GetProcessHeap(), 0, This); } /******************************************************************************* @@ -871,8 +871,8 @@ static ULONG DirectSoundCaptureDevice_Release( HeapFree(GetProcessHeap(), 0, device->pwfx); device->lock.DebugInfo->Spare[0] = 0; DeleteCriticalSection( &(device->lock) ); + TRACE("(%p) released\n", device); HeapFree(GetProcessHeap(), 0, device); - TRACE("(%p) released\n", device); } return ref; } @@ -1099,8 +1099,8 @@ static void capture_destroy(IDirectSoundCaptureImpl *This) { if (This->device) DirectSoundCaptureDevice_Release(This->device); - HeapFree(GetProcessHeap(),0,This); TRACE("(%p) released\n", This); + HeapFree(GetProcessHeap(),0,This); } /******************************************************************************* diff --git a/dlls/dsound/dsound.c b/dlls/dsound/dsound.c index 346cc4ceca3..f2aea64eeed 100644 --- a/dlls/dsound/dsound.c +++ b/dlls/dsound/dsound.c @@ -239,8 +239,8 @@ static ULONG DirectSoundDevice_Release(DirectSoundDevice * device) HeapFree(GetProcessHeap(), 0, device->buffer); device->mixlock.DebugInfo->Spare[0] = 0; DeleteCriticalSection(&device->mixlock); - HeapFree(GetProcessHeap(),0,device); TRACE("(%p) released\n", device); + HeapFree(GetProcessHeap(),0,device); } return ref; } @@ -670,8 +670,8 @@ static void directsound_destroy(IDirectSoundImpl *This) { if (This->device) DirectSoundDevice_Release(This->device); - HeapFree(GetProcessHeap(),0,This); TRACE("(%p) released\n", This); + HeapFree(GetProcessHeap(),0,This); } static inline IDirectSoundImpl *impl_from_IUnknown(IUnknown *iface) diff --git a/dlls/dsound/duplex.c b/dlls/dsound/duplex.c index a3a9a066c31..b7891caa410 100644 --- a/dlls/dsound/duplex.c +++ b/dlls/dsound/duplex.c @@ -61,8 +61,8 @@ static void fullduplex_destroy(IDirectSoundFullDuplexImpl *This) while(IDirectSoundCapture_Release(dsc8) > 0); IUnknown_Release(This->dsc8_unk); } - HeapFree(GetProcessHeap(), 0, This); TRACE("(%p) released\n", This); + HeapFree(GetProcessHeap(), 0, This); } /******************************************************************************* diff --git a/dlls/dsound/propset.c b/dlls/dsound/propset.c index 74d66cad68e..f42cfbf4163 100644 --- a/dlls/dsound/propset.c +++ b/dlls/dsound/propset.c @@ -91,8 +91,8 @@ static ULONG WINAPI IKsPrivatePropertySetImpl_Release(LPKSPROPERTYSET iface) TRACE("(%p) ref %ld\n", This, ref); if (!ref) { + TRACE("(%p) released\n", This); HeapFree(GetProcessHeap(), 0, This); - TRACE("(%p) released\n", This); } return ref; } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/180

June 6, 2022

[PATCH v2 6/9] notepad: Avoid using pointer value after free.

by Rémi Bernon

From: Rémi Bernon <rbernon(a)codeweavers.com> Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- programs/notepad/main.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/programs/notepad/main.c b/programs/notepad/main.c index 210ecd2bfc8..b1cdad8156d 100644 --- a/programs/notepad/main.c +++ b/programs/notepad/main.c @@ -377,10 +377,9 @@ static LPWSTR NOTEPAD_StrRStr(LPWSTR pszSource, LPWSTR pszLast, LPWSTR pszSrch) void NOTEPAD_DoFind(FINDREPLACEW *fr) { LPWSTR content; - LPWSTR found; int len = lstrlenW(fr->lpstrFindWhat); int fileLen; - DWORD pos; + SIZE_T pos; fileLen = GetWindowTextLengthW(Globals.hEdit) + 1; content = HeapAlloc(GetProcessHeap(), 0, fileLen * sizeof(WCHAR)); @@ -391,30 +390,34 @@ void NOTEPAD_DoFind(FINDREPLACEW *fr) switch (fr->Flags & (FR_DOWN|FR_MATCHCASE)) { case 0: - found = StrRStrIW(content, content+pos-len, fr->lpstrFindWhat); + pos = StrRStrIW(content, content+pos-len, fr->lpstrFindWhat) - content; + if (pos == -(SIZE_T)content) pos = ~(SIZE_T)0; break; case FR_DOWN: - found = StrStrIW(content+pos, fr->lpstrFindWhat); + pos = StrStrIW(content+pos, fr->lpstrFindWhat) - content; + if (pos == -(SIZE_T)content) pos = ~(SIZE_T)0; break; case FR_MATCHCASE: - found = NOTEPAD_StrRStr(content, content+pos-len, fr->lpstrFindWhat); + pos = NOTEPAD_StrRStr(content, content+pos-len, fr->lpstrFindWhat) - content; + if (pos == -(SIZE_T)content) pos = ~(SIZE_T)0; break; case FR_DOWN|FR_MATCHCASE: - found = StrStrW(content+pos, fr->lpstrFindWhat); + pos = StrStrW(content+pos, fr->lpstrFindWhat) - content; + if (pos == -(SIZE_T)content) pos = ~(SIZE_T)0; break; default: /* shouldn't happen */ return; } HeapFree(GetProcessHeap(), 0, content); - if (found == NULL) + if (pos == ~(SIZE_T)0) { DIALOG_StringMsgBox(Globals.hFindReplaceDlg, STRING_NOTFOUND, fr->lpstrFindWhat, MB_ICONINFORMATION|MB_OK); return; } - SendMessageW(Globals.hEdit, EM_SETSEL, found - content, found - content + len); + SendMessageW(Globals.hEdit, EM_SETSEL, pos, pos + len); } static void NOTEPAD_DoReplace(FINDREPLACEW *fr) @@ -452,10 +455,9 @@ static void NOTEPAD_DoReplace(FINDREPLACEW *fr) static void NOTEPAD_DoReplaceAll(FINDREPLACEW *fr) { LPWSTR content; - LPWSTR found; int len = lstrlenW(fr->lpstrFindWhat); int fileLen; - DWORD pos; + SIZE_T pos; SendMessageW(Globals.hEdit, EM_SETSEL, 0, 0); while(TRUE){ @@ -468,22 +470,24 @@ static void NOTEPAD_DoReplaceAll(FINDREPLACEW *fr) switch (fr->Flags & (FR_DOWN|FR_MATCHCASE)) { case FR_DOWN: - found = StrStrIW(content+pos, fr->lpstrFindWhat); + pos = StrStrIW(content+pos, fr->lpstrFindWhat) - content; + if (pos == -(SIZE_T)content) pos = ~(SIZE_T)0; break; case FR_DOWN|FR_MATCHCASE: - found = StrStrW(content+pos, fr->lpstrFindWhat); + pos = StrStrW(content+pos, fr->lpstrFindWhat) - content; + if (pos == -(SIZE_T)content) pos = ~(SIZE_T)0; break; default: /* shouldn't happen */ return; } HeapFree(GetProcessHeap(), 0, content); - if(found == NULL) + if(pos == ~(SIZE_T)0) { SendMessageW(Globals.hEdit, EM_SETSEL, 0, 0); return; } - SendMessageW(Globals.hEdit, EM_SETSEL, found - content, found - content + len); + SendMessageW(Globals.hEdit, EM_SETSEL, pos, pos + len); SendMessageW(Globals.hEdit, EM_REPLACESEL, TRUE, (LPARAM)fr->lpstrReplaceWith); } } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/180

June 6, 2022

[PATCH v2 5/9] msi: Avoid using pointer value after free.

by Rémi Bernon

From: Rémi Bernon <rbernon(a)codeweavers.com> Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/msi/handle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/msi/handle.c b/dlls/msi/handle.c index 7be64da9bfe..f0a55956fce 100644 --- a/dlls/msi/handle.c +++ b/dlls/msi/handle.c @@ -256,8 +256,8 @@ int msiobj_release( MSIOBJECTHDR *info ) { if( info->destructor ) info->destructor( info ); - msi_free( info ); TRACE("object %p destroyed\n", info); + msi_free( info ); } return ret; -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/180

June 6, 2022