- Wine-Devel - list.winehq.org

[PATCH] dwrite: Handle memory allocation failures in bidi_compute_bracket_pairs (cppcheck)
by Alex Henrie Dec. 22, 2021

Dec. 22, 2021

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/dwrite/bidi.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/dlls/dwrite/bidi.c b/dlls/dwrite/bidi.c index cc62509b557..df79d3ff58d 100644 --- a/dlls/dwrite/bidi.c +++ b/dlls/dwrite/bidi.c @@ -629,12 +629,14 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run) WCHAR *open_stack; int *stack_index; int stack_top = iso_run->length; - BracketPair *out = NULL; + BracketPair *out = NULL, *new_out; int pair_count = 0; int i; open_stack = malloc(sizeof(WCHAR) * iso_run->length); + if (!open_stack) return NULL; stack_index = malloc(sizeof(int) * iso_run->length); + if (!stack_index) goto done; for (i = 0; i < iso_run->length; i++) { unsigned short ubv = get_table_entry(bidi_bracket_table, iso_run->item[i].ch); @@ -643,6 +645,7 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run) if (!out) { out = malloc(sizeof(BracketPair)); + if (!out) goto done; out[0].start = -1; } @@ -665,7 +668,14 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run) out[pair_count].start = stack_index[j]; out[pair_count].end = i; pair_count++; - out = realloc(out, sizeof(BracketPair) * (pair_count+1)); + new_out = realloc(out, sizeof(BracketPair) * (pair_count+1)); + if (!new_out) + { + free(out); + out = NULL; + goto done; + } + out = new_out; out[pair_count].start = -1; stack_top = j+1; break; @@ -682,6 +692,7 @@ static BracketPair *bidi_compute_bracket_pairs(IsolatedRun *iso_run) else if (pair_count > 1) qsort(out, pair_count, sizeof(BracketPair), bracketpair_compr); +done: free(open_stack); free(stack_index); return out; -- 2.34.1

2 1

[PATCH vkd3d v3 07/12] vkd3d-shader/hlsl: Add dimension types for textures to enum hlsl_sampler_dim.
by Francisco Casas Dec. 22, 2021

Dec. 22, 2021

Signed-off-by: Francisco Casas <fcasas(a)codeweavers.com> --- libs/vkd3d-shader/hlsl.c | 25 +++++++++++++++---------- libs/vkd3d-shader/hlsl.h | 10 ++++++++-- libs/vkd3d-shader/hlsl_sm4.c | 2 +- 3 files changed, 24 insertions(+), 13 deletions(-) diff --git a/libs/vkd3d-shader/hlsl.c b/libs/vkd3d-shader/hlsl.c index c664d5b1..2bd4b5c8 100644 --- a/libs/vkd3d-shader/hlsl.c +++ b/libs/vkd3d-shader/hlsl.c @@ -929,10 +929,15 @@ struct vkd3d_string_buffer *hlsl_type_to_string(struct hlsl_ctx *ctx, const stru { static const char *const dimensions[] = { - [HLSL_SAMPLER_DIM_1D] = "1D", - [HLSL_SAMPLER_DIM_2D] = "2D", - [HLSL_SAMPLER_DIM_3D] = "3D", - [HLSL_SAMPLER_DIM_CUBE] = "Cube" + [HLSL_SAMPLER_DIM_1D] = "1D", + [HLSL_SAMPLER_DIM_2D] = "2D", + [HLSL_SAMPLER_DIM_3D] = "3D", + [HLSL_SAMPLER_DIM_CUBE] = "Cube", + [HLSL_SAMPLER_DIM_1DARRAY] = "1DArray", + [HLSL_SAMPLER_DIM_2DARRAY] = "2DArray", + [HLSL_SAMPLER_DIM_2DMS] = "2DMS", + [HLSL_SAMPLER_DIM_2DMSARRAY] = "2DMSArray", + [HLSL_SAMPLER_DIM_CUBEARRAY] = "CubeArray", }; switch (type->base_type) @@ -1776,11 +1781,11 @@ static void declare_predefined_types(struct hlsl_ctx *ctx) static const char *const sampler_names[] = { - "sampler", - "sampler1D", - "sampler2D", - "sampler3D", - "samplerCUBE" + [HLSL_SAMPLER_DIM_GENERIC] = "sampler", + [HLSL_SAMPLER_DIM_1D] = "sampler1D", + [HLSL_SAMPLER_DIM_2D] = "sampler2D", + [HLSL_SAMPLER_DIM_3D] = "sampler3D", + [HLSL_SAMPLER_DIM_CUBE] = "samplerCUBE", }; static const struct @@ -1832,7 +1837,7 @@ static void declare_predefined_types(struct hlsl_ctx *ctx) } } - for (bt = 0; bt <= HLSL_SAMPLER_DIM_MAX; ++bt) + for (bt = 0; bt <= HLSL_SAMPLER_DIM_LAST_SAMPLER; ++bt) { type = hlsl_new_type(ctx, sampler_names[bt], HLSL_CLASS_OBJECT, HLSL_TYPE_SAMPLER, 1, 1); type->sampler_dim = bt; diff --git a/libs/vkd3d-shader/hlsl.h b/libs/vkd3d-shader/hlsl.h index 49fa8d9d..334610df 100644 --- a/libs/vkd3d-shader/hlsl.h +++ b/libs/vkd3d-shader/hlsl.h @@ -98,7 +98,13 @@ enum hlsl_sampler_dim HLSL_SAMPLER_DIM_2D, HLSL_SAMPLER_DIM_3D, HLSL_SAMPLER_DIM_CUBE, - HLSL_SAMPLER_DIM_MAX = HLSL_SAMPLER_DIM_CUBE + HLSL_SAMPLER_DIM_LAST_SAMPLER = HLSL_SAMPLER_DIM_CUBE, + HLSL_SAMPLER_DIM_1DARRAY, + HLSL_SAMPLER_DIM_2DARRAY, + HLSL_SAMPLER_DIM_2DMS, + HLSL_SAMPLER_DIM_2DMSARRAY, + HLSL_SAMPLER_DIM_CUBEARRAY, + HLSL_SAMPLER_DIM_MAX = HLSL_SAMPLER_DIM_CUBEARRAY, }; enum hlsl_matrix_majority @@ -489,7 +495,7 @@ struct hlsl_ctx struct hlsl_type *vector[HLSL_TYPE_LAST_SCALAR + 1][4]; /* matrix[float][2][4] is a float4x2, i.e. dimx = 2, dimy = 4 */ struct hlsl_type *matrix[HLSL_TYPE_LAST_SCALAR + 1][4][4]; - struct hlsl_type *sampler[HLSL_SAMPLER_DIM_MAX + 1]; + struct hlsl_type *sampler[HLSL_SAMPLER_DIM_LAST_SAMPLER + 1]; struct hlsl_type *Void; } builtin_types; diff --git a/libs/vkd3d-shader/hlsl_sm4.c b/libs/vkd3d-shader/hlsl_sm4.c index be35d125..cefe173d 100644 --- a/libs/vkd3d-shader/hlsl_sm4.c +++ b/libs/vkd3d-shader/hlsl_sm4.c @@ -1291,7 +1291,7 @@ static void write_sm4_ld(struct hlsl_ctx *ctx, struct vkd3d_bytecode_buffer *buf case HLSL_SAMPLER_DIM_CUBE: break; - case HLSL_SAMPLER_DIM_GENERIC: + default: assert(0); } -- 2.25.1

3 6

[PATCH] reg: Handle memory allocation failures in run_delete (cppcheck)
by Alex Henrie Dec. 22, 2021

Dec. 22, 2021

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- programs/reg/delete.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/programs/reg/delete.c b/programs/reg/delete.c index cf0108664fd..344fb6614c5 100644 --- a/programs/reg/delete.c +++ b/programs/reg/delete.c @@ -87,9 +87,14 @@ static int run_delete(HKEY root, WCHAR *path, REGSAM sam, WCHAR *key_name, WCHAR if (value_all) { DWORD max_value_len = 256, value_len; - WCHAR *value_name; + WCHAR *value_name, *new_value_name; value_name = malloc(max_value_len * sizeof(WCHAR)); + if (!value_name) + { + output_error(ERROR_NOT_ENOUGH_MEMORY); + return 1; + } while (1) { @@ -110,7 +115,13 @@ static int run_delete(HKEY root, WCHAR *path, REGSAM sam, WCHAR *key_name, WCHAR else if (rc == ERROR_MORE_DATA) { max_value_len *= 2; - value_name = realloc(value_name, max_value_len * sizeof(WCHAR)); + new_value_name = realloc(value_name, max_value_len * sizeof(WCHAR)); + if (!new_value_name) + { + output_error(ERROR_NOT_ENOUGH_MEMORY); + return 1; + } + value_name = new_value_name; } else break; } -- 2.34.1

1 0

[PATCH v2] ws2_32: Fix memory leaks on error paths in unix_gethostby* (scan-build)
by Alex Henrie Dec. 22, 2021

Dec. 22, 2021

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- v2: Don't free before the call to hostent_from_unix --- dlls/ws2_32/unixlib.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dlls/ws2_32/unixlib.c b/dlls/ws2_32/unixlib.c index e89ebe35248..1f82aee81de 100644 --- a/dlls/ws2_32/unixlib.c +++ b/dlls/ws2_32/unixlib.c @@ -866,7 +866,10 @@ static NTSTATUS unix_gethostbyaddr( void *args ) } if (!unix_host) + { + free( unix_buffer ); return (locerr < 0 ? errno_from_unix( errno ) : host_errno_from_unix( locerr )); + } ret = hostent_from_unix( unix_host, params->host, params->size ); @@ -916,7 +919,10 @@ static NTSTATUS unix_gethostbyname( void *args ) } if (!unix_host) + { + free( unix_buffer ); return (locerr < 0 ? errno_from_unix( errno ) : host_errno_from_unix( locerr )); + } ret = hostent_from_unix( unix_host, params->host, params->size ); -- 2.34.1

1 0

[PATCH] quartz/tests: Test querying connection state inside of IPin::ReceiveConnection().
by Zebediah Figura Dec. 22, 2021

Dec. 22, 2021

Signed-off-by: Zebediah Figura <zfigura(a)codeweavers.com> --- dlls/quartz/tests/avisplit.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/dlls/quartz/tests/avisplit.c b/dlls/quartz/tests/avisplit.c index 10088c033b7..80ee6607279 100644 --- a/dlls/quartz/tests/avisplit.c +++ b/dlls/quartz/tests/avisplit.c @@ -913,6 +913,25 @@ static HRESULT testsink_get_media_type(struct strmbase_pin *iface, unsigned int return VFW_S_NO_MORE_ITEMS; } +static HRESULT testsink_connect(struct strmbase_sink *iface, IPin *peer, const AM_MEDIA_TYPE *mt) +{ + AM_MEDIA_TYPE mt2; + IPin *peer2; + HRESULT hr; + + hr = IPin_ConnectedTo(peer, &peer2); + ok(hr == S_OK, "Got hr %#x.\n", hr); + ok(peer2 == &iface->pin.IPin_iface, "Peer didn't match.\n"); + IPin_Release(peer2); + + hr = IPin_ConnectionMediaType(peer, &mt2); + ok(hr == S_OK, "Got hr %#x.\n", hr); + ok(compare_media_types(mt, &mt2), "Media types didn't match.\n"); + FreeMediaType(&mt2); + + return S_OK; +} + static HRESULT WINAPI testsink_Receive(struct strmbase_sink *iface, IMediaSample *sample) { struct testfilter *filter = impl_from_strmbase_filter(iface->pin.filter); @@ -976,6 +995,7 @@ static const struct strmbase_sink_ops testsink_ops = .base.pin_query_interface = testsink_query_interface, .base.pin_query_accept = testsink_query_accept, .base.pin_get_media_type = testsink_get_media_type, + .sink_connect = testsink_connect, .pfnReceive = testsink_Receive, .sink_eos = testsink_eos, .sink_new_segment = testsink_new_segment, -- 2.34.1

2 1

[PATCH] server: Avoid using the long double type on non-x86 platforms.
by Zebediah Figura Dec. 22, 2021

Dec. 22, 2021

We especially may want to support x86 on ARM, where long double is not an 80-bit type. Signed-off-by: Zebediah Figura <zfigura(a)codeweavers.com> --- server/trace.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/server/trace.c b/server/trace.c index a1a8726ba71..a48f00258fe 100644 --- a/server/trace.c +++ b/server/trace.c @@ -666,9 +666,11 @@ static void dump_varargs_context( const char *prefix, data_size_t size ) ctx.fp.i386_regs.data_off, ctx.fp.i386_regs.data_sel, ctx.fp.i386_regs.cr0npx ); for (i = 0; i < 8; i++) { - long double reg = 0; - memcpy( &reg, &ctx.fp.i386_regs.regs[10 * i], 10 ); - fprintf( stderr, ",fp.reg%u=%Lg", i, reg ); + unsigned __int64 reg[2]; + memset( reg, 0, sizeof(reg) ); + memcpy( reg, &ctx.fp.i386_regs.regs[10 * i], 10 ); + fprintf( stderr, ",fp.reg%u=", i ); + dump_uint128( "", reg ); } } if (ctx.flags & SERVER_CTX_EXTENDED_REGISTERS) -- 2.34.1

1 0

[PATCH] winex11: Fix the build when XInput2 headers are not present.
by Zebediah Figura Dec. 22, 2021

Dec. 22, 2021

Signed-off-by: Zebediah Figura <zfigura(a)codeweavers.com> --- dlls/winex11.drv/mouse.c | 155 ++++++++++++++++++++------------------- 1 file changed, 79 insertions(+), 76 deletions(-) diff --git a/dlls/winex11.drv/mouse.c b/dlls/winex11.drv/mouse.c index 9e56e080bda..51a6828f10c 100644 --- a/dlls/winex11.drv/mouse.c +++ b/dlls/winex11.drv/mouse.c @@ -275,7 +275,6 @@ static void update_relative_valuators(XIAnyClassInfo **valuators, int n_valuator thread_data->x_valuator.value = 0; thread_data->y_valuator.value = 0; } -#endif /*********************************************************************** @@ -283,7 +282,6 @@ static void update_relative_valuators(XIAnyClassInfo **valuators, int n_valuator */ static void enable_xinput2(void) { -#ifdef HAVE_X11_EXTENSIONS_XINPUT2_H struct x11drv_thread_data *data = x11drv_thread_data(); XIEventMask mask; XIDeviceInfo *pointer_info; @@ -330,9 +328,10 @@ static void enable_xinput2(void) data->xi2_current_slave = 0; data->xi2_state = xi_enabled; -#endif } +#endif + /*********************************************************************** * disable_xinput2 */ @@ -371,6 +370,7 @@ static void disable_xinput2(void) */ static BOOL grab_clipping_window( const RECT *clip ) { +#if HAVE_X11_EXTENSIONS_XINPUT2_H static const WCHAR messageW[] = {'M','e','s','s','a','g','e',0}; struct x11drv_thread_data *data = x11drv_thread_data(); Window clip_window; @@ -441,6 +441,10 @@ static BOOL grab_clipping_window( const RECT *clip ) data->clip_hwnd = msg_hwnd; SendNotifyMessageW( GetDesktopWindow(), WM_X11DRV_CLIP_CURSOR_NOTIFY, 0, (LPARAM)msg_hwnd ); return TRUE; +#else + WARN( "XInput2 was not available at compile time\n" ); + return FALSE; +#endif } /*********************************************************************** @@ -628,79 +632,6 @@ static void map_event_coords( HWND hwnd, Window window, Window event_root, int x input->u.mi.dy = pt.y; } -static BOOL map_raw_event_coords( XIRawEvent *event, INPUT *input ) -{ - struct x11drv_thread_data *thread_data = x11drv_thread_data(); - XIValuatorClassInfo *x = &thread_data->x_valuator, *y = &thread_data->y_valuator; - double x_value = 0, y_value = 0, x_scale, y_scale; - const double *values = event->valuators.values; - RECT virtual_rect; - int i; - - if (x->number < 0 || y->number < 0) return FALSE; - if (!event->valuators.mask_len) return FALSE; - if (thread_data->xi2_state != xi_enabled) return FALSE; - - /* If there is no slave currently detected, no previous motion nor device - * change events were received. Look it up now on the device list in this - * case. - */ - if (!thread_data->xi2_current_slave) - { - XIDeviceInfo *devices = thread_data->xi2_devices; - - for (i = 0; i < thread_data->xi2_device_count; i++) - { - if (devices[i].use != XISlavePointer) continue; - if (devices[i].deviceid != event->deviceid) continue; - if (devices[i].attachment != thread_data->xi2_core_pointer) continue; - thread_data->xi2_current_slave = event->deviceid; - break; - } - } - if (event->deviceid != thread_data->xi2_current_slave) return FALSE; - - virtual_rect = get_virtual_screen_rect(); - - if (x->max <= x->min) x_scale = 1; - else x_scale = (virtual_rect.right - virtual_rect.left) / (x->max - x->min); - if (y->max <= y->min) y_scale = 1; - else y_scale = (virtual_rect.bottom - virtual_rect.top) / (y->max - y->min); - - for (i = 0; i <= max( x->number, y->number ); i++) - { - if (!XIMaskIsSet( event->valuators.mask, i )) continue; - if (i == x->number) - { - x_value = *values; - x->value += x_value * x_scale; - } - if (i == y->number) - { - y_value = *values; - y->value += y_value * y_scale; - } - values++; - } - - input->u.mi.dx = round( x->value ); - input->u.mi.dy = round( y->value ); - - TRACE( "event %f,%f value %f,%f input %d,%d\n", x_value, y_value, x->value, y->value, input->u.mi.dx, input->u.mi.dy ); - - x->value -= input->u.mi.dx; - y->value -= input->u.mi.dy; - - if (!input->u.mi.dx && !input->u.mi.dy) - { - TRACE( "accumulating motion\n" ); - return FALSE; - } - - return TRUE; -} - - /*********************************************************************** * send_mouse_input * @@ -1887,6 +1818,78 @@ static BOOL X11DRV_DeviceChanged( XGenericEventCookie *xev ) return TRUE; } +static BOOL map_raw_event_coords( XIRawEvent *event, INPUT *input ) +{ + struct x11drv_thread_data *thread_data = x11drv_thread_data(); + XIValuatorClassInfo *x = &thread_data->x_valuator, *y = &thread_data->y_valuator; + double x_value = 0, y_value = 0, x_scale, y_scale; + const double *values = event->valuators.values; + RECT virtual_rect; + int i; + + if (x->number < 0 || y->number < 0) return FALSE; + if (!event->valuators.mask_len) return FALSE; + if (thread_data->xi2_state != xi_enabled) return FALSE; + + /* If there is no slave currently detected, no previous motion nor device + * change events were received. Look it up now on the device list in this + * case. + */ + if (!thread_data->xi2_current_slave) + { + XIDeviceInfo *devices = thread_data->xi2_devices; + + for (i = 0; i < thread_data->xi2_device_count; i++) + { + if (devices[i].use != XISlavePointer) continue; + if (devices[i].deviceid != event->deviceid) continue; + if (devices[i].attachment != thread_data->xi2_core_pointer) continue; + thread_data->xi2_current_slave = event->deviceid; + break; + } + } + if (event->deviceid != thread_data->xi2_current_slave) return FALSE; + + virtual_rect = get_virtual_screen_rect(); + + if (x->max <= x->min) x_scale = 1; + else x_scale = (virtual_rect.right - virtual_rect.left) / (x->max - x->min); + if (y->max <= y->min) y_scale = 1; + else y_scale = (virtual_rect.bottom - virtual_rect.top) / (y->max - y->min); + + for (i = 0; i <= max( x->number, y->number ); i++) + { + if (!XIMaskIsSet( event->valuators.mask, i )) continue; + if (i == x->number) + { + x_value = *values; + x->value += x_value * x_scale; + } + if (i == y->number) + { + y_value = *values; + y->value += y_value * y_scale; + } + values++; + } + + input->u.mi.dx = round( x->value ); + input->u.mi.dy = round( y->value ); + + TRACE( "event %f,%f value %f,%f input %d,%d\n", x_value, y_value, x->value, y->value, input->u.mi.dx, input->u.mi.dy ); + + x->value -= input->u.mi.dx; + y->value -= input->u.mi.dy; + + if (!input->u.mi.dx && !input->u.mi.dy) + { + TRACE( "accumulating motion\n" ); + return FALSE; + } + + return TRUE; +} + /*********************************************************************** * X11DRV_RawMotion */ -- 2.34.1

1 0

[PATCH] po: Update LIthuanian translation.
by Aurimas Fišeras Dec. 21, 2021

Dec. 21, 2021

2 1

[RFC PATCH] ntdll: Swallow crashes once pthread_exit() has been called.
by Giovanni Mascellani Dec. 21, 2021

Dec. 21, 2021

When pthread_exit() is called, it tries to rewind the stack, which includes calling cleanup routines registered with pthread_cleanup_push() or similar procedures. But we also unwind the stack in signal_exit_thread(). This means that if any cleanup routine was registered between the exit frame and where control was when the thread was interrupted, then pthread will try to call functions from frames that do not exist anymore and might have been overwritten, which easily results in segmentation faults or similar accidents. Since until PE separation is finished it is not easy to fix the real problem, this patch logs and swallows crashes occurring after pthread_exit() is called, so that at least damages are minimized and developers are not confused by irrelevant messages. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52213 --- dlls/ntdll/unix/signal_arm.c | 6 ++++++ dlls/ntdll/unix/signal_arm64.c | 6 ++++++ dlls/ntdll/unix/signal_i386.c | 6 ++++++ dlls/ntdll/unix/signal_x86_64.c | 6 ++++++ dlls/ntdll/unix/thread.c | 2 ++ dlls/ntdll/unix/unix_private.h | 1 + 6 files changed, 27 insertions(+) diff --git a/dlls/ntdll/unix/signal_arm.c b/dlls/ntdll/unix/signal_arm.c index ebc08984adf..b552bdb79f9 100644 --- a/dlls/ntdll/unix/signal_arm.c +++ b/dlls/ntdll/unix/signal_arm.c @@ -800,6 +800,12 @@ static void segv_handler( int signal, siginfo_t *siginfo, void *sigcontext ) EXCEPTION_RECORD rec = { 0 }; ucontext_t *context = sigcontext; + if (ntdll_get_thread_data()->exiting_pthread) + { + WARN("Swallowing crash after pthread is exiting\n"); + syscall(__NR_exit, 0); + } + switch (get_trap_code(signal, context)) { case TRAP_ARM_PRIVINFLT: /* Invalid opcode exception */ diff --git a/dlls/ntdll/unix/signal_arm64.c b/dlls/ntdll/unix/signal_arm64.c index f2612412366..10da9b8a366 100644 --- a/dlls/ntdll/unix/signal_arm64.c +++ b/dlls/ntdll/unix/signal_arm64.c @@ -854,6 +854,12 @@ static void segv_handler( int signal, siginfo_t *siginfo, void *sigcontext ) EXCEPTION_RECORD rec = { 0 }; ucontext_t *context = sigcontext; + if (ntdll_get_thread_data()->exiting_pthread) + { + WARN("Swallowing crash after pthread is exiting\n"); + syscall(__NR_exit, 0); + } + rec.NumberParameters = 2; rec.ExceptionInformation[0] = (get_fault_esr( context ) & 0x40) != 0; rec.ExceptionInformation[1] = (ULONG_PTR)siginfo->si_addr; diff --git a/dlls/ntdll/unix/signal_i386.c b/dlls/ntdll/unix/signal_i386.c index bf3abc1a587..1d4f8ec9df1 100644 --- a/dlls/ntdll/unix/signal_i386.c +++ b/dlls/ntdll/unix/signal_i386.c @@ -1774,6 +1774,12 @@ static void segv_handler( int signal, siginfo_t *siginfo, void *sigcontext ) ucontext_t *ucontext = sigcontext; void *stack = setup_exception_record( sigcontext, &rec, &xcontext ); + if (ntdll_get_thread_data()->exiting_pthread) + { + WARN("Swallowing crash after pthread is exiting\n"); + syscall(__NR_exit, 0); + } + switch (TRAP_sig(ucontext)) { case TRAP_x86_OFLOW: /* Overflow exception */ diff --git a/dlls/ntdll/unix/signal_x86_64.c b/dlls/ntdll/unix/signal_x86_64.c index d32e38875a4..6454d2e6b26 100644 --- a/dlls/ntdll/unix/signal_x86_64.c +++ b/dlls/ntdll/unix/signal_x86_64.c @@ -2551,6 +2551,12 @@ static void segv_handler( int signal, siginfo_t *siginfo, void *sigcontext ) struct xcontext context; ucontext_t *ucontext = sigcontext; + if (ntdll_get_thread_data()->exiting_pthread) + { + WARN("Swallowing crash after pthread is exiting\n"); + syscall(__NR_exit, 0); + } + rec.ExceptionAddress = (void *)RIP_sig(ucontext); save_context( &context, sigcontext ); diff --git a/dlls/ntdll/unix/thread.c b/dlls/ntdll/unix/thread.c index 00fe2b6fa1b..8a22b68605a 100644 --- a/dlls/ntdll/unix/thread.c +++ b/dlls/ntdll/unix/thread.c @@ -1055,6 +1055,7 @@ static void pthread_exit_wrapper( int status ) close( ntdll_get_thread_data()->wait_fd[1] ); close( ntdll_get_thread_data()->reply_fd ); close( ntdll_get_thread_data()->request_fd ); + ntdll_get_thread_data()->exiting_pthread = TRUE; pthread_exit( UIntToPtr(status) ); } @@ -1342,6 +1343,7 @@ NTSTATUS WINAPI NtCreateThreadEx( HANDLE *handle, ACCESS_MASK access, OBJECT_ATT thread_data->request_fd = request_pipe[1]; thread_data->start = start; thread_data->param = param; + thread_data->exiting_pthread = FALSE; pthread_attr_init( &pthread_attr ); pthread_attr_setstack( &pthread_attr, teb->DeallocationStack, diff --git a/dlls/ntdll/unix/unix_private.h b/dlls/ntdll/unix/unix_private.h index 0dcb09ad641..0d1117be2e3 100644 --- a/dlls/ntdll/unix/unix_private.h +++ b/dlls/ntdll/unix/unix_private.h @@ -61,6 +61,7 @@ struct ntdll_thread_data PRTL_THREAD_START_ROUTINE start; /* thread entry point */ void *param; /* thread entry point parameter */ void *jmp_buf; /* setjmp buffer for exception handling */ + BOOL exiting_pthread; }; C_ASSERT( sizeof(struct ntdll_thread_data) <= sizeof(((TEB *)0)->GdiTebBatch) ); -- 2.34.1

3 3

[PATCH] msxml3: Fix crashes due to access to invalid context pointer.
by Bernhard Übelacker Dec. 21, 2021

Dec. 21, 2021

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52073 Signed-off-by: Bernhard Übelacker <bernhardu(a)mailbox.org> ---- Unchanged to previous [RFC]. In function xslt_doc_default_loader a pointer of the stack based variable "xmlParserInputPtr input" is given to bind_url. Later in function import_loader_onDataAvailable this pointer appears as parameter "void *ctxt" which correctly gets casted to "xmlParserInputPtr *input", but in my opinion incorrectly given to xmlNewIOInputStream as parameter "xmlParserCtxtPtr ctxt". In the next call to xmlNewInputStream this xmlParserCtxtPtr is used to increment the input_id member. By accident this input_id member contains the pointer which causes in xmlXPathNodeCollectAndTest the segfault. --- dlls/msxml3/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/msxml3/node.c b/dlls/msxml3/node.c index 721ad54e379..272e438e773 100644 --- a/dlls/msxml3/node.c +++ b/dlls/msxml3/node.c @@ -1329,7 +1329,7 @@ static HRESULT import_loader_onDataAvailable(void *ctxt, char *ptr, DWORD len) inputbuffer = xmlParserInputBufferCreateIO(import_loader_io_read, import_loader_io_close, buffer, XML_CHAR_ENCODING_NONE); - *input = xmlNewIOInputStream(ctxt, inputbuffer, XML_CHAR_ENCODING_NONE); + *input = xmlNewIOInputStream(NULL, inputbuffer, XML_CHAR_ENCODING_NONE); if (!*input) xmlFreeParserInputBuffer(inputbuffer); -- 2.34.1

2 1