- Wine-Devel - list.winehq.org

[RFC] msxml3: Fix crashes due to access to invalid context pointer.
by Bernhard Übelacker Dec. 20, 2021

Dec. 20, 2021

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52073 In function xslt_doc_default_loader a pointer of the stack based variable "xmlParserInputPtr input" is given to bind_url. Later in function import_loader_onDataAvailable this pointer appears as parameter "void *ctxt" which correctly gets casted to "xmlParserInputPtr *input", but in my opinion incorrectly given to xmlNewIOInputStream as parameter "xmlParserCtxtPtr ctxt". In the next call to xmlNewInputStream this xmlParserCtxtPtr is used to increment the input_id member. By accident this input_id member contains the pointer which causes in xmlXPathNodeCollectAndTest the segfault. --- dlls/msxml3/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/msxml3/node.c b/dlls/msxml3/node.c index 721ad54e379..272e438e773 100644 --- a/dlls/msxml3/node.c +++ b/dlls/msxml3/node.c @@ -1329,7 +1329,7 @@ static HRESULT import_loader_onDataAvailable(void *ctxt, char *ptr, DWORD len) inputbuffer = xmlParserInputBufferCreateIO(import_loader_io_read, import_loader_io_close, buffer, XML_CHAR_ENCODING_NONE); - *input = xmlNewIOInputStream(ctxt, inputbuffer, XML_CHAR_ENCODING_NONE); + *input = xmlNewIOInputStream(NULL, inputbuffer, XML_CHAR_ENCODING_NONE); if (!*input) xmlFreeParserInputBuffer(inputbuffer); -- 2.34.1

2 2

[PATCH] win32u: Fix memory leak on error path in PATH_WidenPath (cppcheck)
by Alex Henrie Dec. 20, 2021

Dec. 20, 2021

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/win32u/path.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/win32u/path.c b/dlls/win32u/path.c index 05123a2f2e4..ada76bb4a7a 100644 --- a/dlls/win32u/path.c +++ b/dlls/win32u/path.c @@ -1616,7 +1616,7 @@ BOOL WINAPI NtGdiFlattenPath( HDC hdc ) static struct gdi_path *PATH_WidenPath(DC *dc) { INT i, j, numStrokes, penWidth, penWidthIn, penWidthOut, size, penStyle; - struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, *pUpPath, *pDownPath; + struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, **pNewStrokes, *pUpPath, *pDownPath; EXTLOGPEN *elp; BYTE *type; DWORD obj_type, joint, endcap, penType; @@ -1681,12 +1681,14 @@ static struct gdi_path *PATH_WidenPath(DC *dc) case PT_MOVETO: numStrokes++; j = 0; - pStrokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); - if(!pStrokes) + pNewStrokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); + if(!pNewStrokes) { free_gdi_path(flat_path); + free(pStrokes); return NULL; } + pStrokes = pNewStrokes; pStrokes[numStrokes - 1] = alloc_gdi_path(0); /* fall through */ case PT_LINETO: -- 2.34.1

2 1

[PATCH v2] win32u: Fix memory leak on error path in PATH_WidenPath (cppcheck)
by Huw Davies Dec. 20, 2021

Dec. 20, 2021

From: Alex Henrie <alexhenrie24(a)gmail.com> Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> Signed-off-by: Huw Davies <huw(a)codeweavers.com> --- dlls/win32u/path.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/win32u/path.c b/dlls/win32u/path.c index 05123a2f2e4..a87a7ab06c2 100644 --- a/dlls/win32u/path.c +++ b/dlls/win32u/path.c @@ -1616,7 +1616,7 @@ BOOL WINAPI NtGdiFlattenPath( HDC hdc ) static struct gdi_path *PATH_WidenPath(DC *dc) { INT i, j, numStrokes, penWidth, penWidthIn, penWidthOut, size, penStyle; - struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, *pUpPath, *pDownPath; + struct gdi_path *flat_path, *pNewPath, **pStrokes = NULL, **new_strokes, *pUpPath, *pDownPath; EXTLOGPEN *elp; BYTE *type; DWORD obj_type, joint, endcap, penType; @@ -1681,12 +1681,14 @@ static struct gdi_path *PATH_WidenPath(DC *dc) case PT_MOVETO: numStrokes++; j = 0; - pStrokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); - if(!pStrokes) + new_strokes = realloc( pStrokes, numStrokes * sizeof(*pStrokes) ); + if (!new_strokes) { free_gdi_path(flat_path); + free(pStrokes); return NULL; } + pStrokes = new_strokes; pStrokes[numStrokes - 1] = alloc_gdi_path(0); /* fall through */ case PT_LINETO: -- 2.23.0

1 0

[PATCH] nsiproxy: Fix memory leaks on error paths in get_ipv6_addr_scope_table (cppcheck)
by Alex Henrie Dec. 20, 2021

Dec. 20, 2021

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/nsiproxy.sys/tcp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dlls/nsiproxy.sys/tcp.c b/dlls/nsiproxy.sys/tcp.c index 6dd0aaa9b45..0cd81ae86e5 100644 --- a/dlls/nsiproxy.sys/tcp.c +++ b/dlls/nsiproxy.sys/tcp.c @@ -235,7 +235,7 @@ static inline MIB_TCP_STATE tcp_state_to_mib_state( int state ) struct ipv6_addr_scope *get_ipv6_addr_scope_table( unsigned int *size ) { - struct ipv6_addr_scope *table = NULL; + struct ipv6_addr_scope *table = NULL, *new_table; unsigned int table_size = 0, num = 0; #ifdef __linux__ @@ -260,11 +260,12 @@ struct ipv6_addr_scope *get_ipv6_addr_scope_table( unsigned int *size ) { if (!table_size) table_size = 4; else table_size *= 2; - if (!(table = realloc( table, table_size * sizeof(table[0]) ))) + if (!(new_table = realloc( table, table_size * sizeof(table[0]) ))) { fclose( fp ); goto failed; } + table = new_table; } entry = table + num - 1; @@ -292,11 +293,12 @@ struct ipv6_addr_scope *get_ipv6_addr_scope_table( unsigned int *size ) { if (!table_size) table_size = 4; else table_size *= 2; - if (!(table = realloc( table, table_size * sizeof(table[0]) ))) + if (!(new_table = realloc( table, table_size * sizeof(table[0]) ))) { freeifaddrs( addrs ); goto failed; } + table = new_table; } sin6 = (struct sockaddr_in6 *)cur->ifa_addr; -- 2.34.1

2 1

[PATCH] win32u: Use null driver to handle virtual display devices.
by Jacek Caban Dec. 20, 2021

Dec. 20, 2021

All drivers support UpdateDisplayDevices now, so we can avoid a server call by being explicit in the null driver. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52180 Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/win32u/driver.c | 1 + dlls/win32u/sysparams.c | 48 ++++++++++++----------------------------- 2 files changed, 15 insertions(+), 34 deletions(-)

2 1

[PATCH] ole32: Don't change attr->ObjectName in create_key (cppcheck)
by Alex Henrie Dec. 20, 2021

Dec. 20, 2021

ObjectName can't point to a local variable because it is used later outside of this function. Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/ole32/compobj.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/dlls/ole32/compobj.c b/dlls/ole32/compobj.c index 815fdcb11d0..66cc81470b1 100644 --- a/dlls/ole32/compobj.c +++ b/dlls/ole32/compobj.c @@ -216,18 +216,16 @@ static NTSTATUS create_key( HKEY *retkey, ACCESS_MASK access, OBJECT_ATTRIBUTES HANDLE subkey, root = attr->RootDirectory; WCHAR *buffer = attr->ObjectName->Buffer; DWORD attrs, pos = 0, i = 0, len = attr->ObjectName->Length / sizeof(WCHAR); - UNICODE_STRING str; while (i < len && buffer[i] != '\\') i++; if (i == len) return status; attrs = attr->Attributes; - attr->ObjectName = &str; while (i < len) { - str.Buffer = buffer + pos; - str.Length = (i - pos) * sizeof(WCHAR); + attr->ObjectName->Buffer = buffer + pos; + attr->ObjectName->Length = (i - pos) * sizeof(WCHAR); status = NtCreateKey( &subkey, access, attr, 0, NULL, 0, NULL ); if (attr->RootDirectory != root) NtClose( attr->RootDirectory ); if (status) return status; @@ -236,8 +234,8 @@ static NTSTATUS create_key( HKEY *retkey, ACCESS_MASK access, OBJECT_ATTRIBUTES pos = i; while (i < len && buffer[i] != '\\') i++; } - str.Buffer = buffer + pos; - str.Length = (i - pos) * sizeof(WCHAR); + attr->ObjectName->Buffer = buffer + pos; + attr->ObjectName->Length = (i - pos) * sizeof(WCHAR); attr->Attributes = attrs; status = NtCreateKey( (PHANDLE)retkey, access, attr, 0, NULL, 0, NULL ); if (attr->RootDirectory != root) NtClose( attr->RootDirectory ); -- 2.34.1

1 0

[PATCH] ws2_32: Fix memory leak on error path in get_local_ips (cppcheck)
by Alex Henrie Dec. 20, 2021

Dec. 20, 2021

Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/ws2_32/protocol.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/dlls/ws2_32/protocol.c b/dlls/ws2_32/protocol.c index 867e9513ca2..56b7379cccc 100644 --- a/dlls/ws2_32/protocol.c +++ b/dlls/ws2_32/protocol.c @@ -806,7 +806,7 @@ static struct hostent *get_local_ips( char *hostname ) IP_ADAPTER_INFO *adapters = NULL, *k; struct hostent *hostlist = NULL; MIB_IPFORWARDTABLE *routes = NULL; - struct route *route_addrs = NULL; + struct route *route_addrs = NULL, *new_route_addrs; DWORD adap_size, route_size, n; /* Obtain the size of the adapter list and routing table, also allocate memory */ @@ -852,9 +852,10 @@ static struct hostent *get_local_ips( char *hostname ) } if (exists) continue; - route_addrs = realloc( route_addrs, (numroutes + 1) * sizeof(struct route) ); - if (!route_addrs) + new_route_addrs = realloc( route_addrs, (numroutes + 1) * sizeof(struct route) ); + if (!new_route_addrs) goto cleanup; + route_addrs = new_route_addrs; route_addrs[numroutes].interface = ifindex; route_addrs[numroutes].metric = ifmetric; route_addrs[numroutes].default_route = ifdefault; -- 2.34.1

1 0

[PATCH] mountmgr: Change scope of variable pvd in VOLUME_GetSuperblockLabel (cppcheck)
by Alex Henrie Dec. 20, 2021

Dec. 20, 2021

The data in pvd was being accessed through the label_ptr variable after pvd went out of scope. Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> --- dlls/mountmgr.sys/device.c | 43 ++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 23 deletions(-) diff --git a/dlls/mountmgr.sys/device.c b/dlls/mountmgr.sys/device.c index d4f77012bbe..b8a0040195d 100644 --- a/dlls/mountmgr.sys/device.c +++ b/dlls/mountmgr.sys/device.c @@ -398,6 +398,7 @@ static void VOLUME_GetSuperblockLabel( struct volume *volume, HANDLE handle, con { const BYTE *label_ptr = NULL; DWORD label_len; + BYTE pvd[BLOCK_SIZE]; switch (volume->fs_type) { @@ -435,32 +436,28 @@ static void VOLUME_GetSuperblockLabel( struct volume *volume, HANDLE handle, con break; } case FS_UDF: + if(!UDF_Find_PVD(handle, pvd)) { - BYTE pvd[BLOCK_SIZE]; - - if(!UDF_Find_PVD(handle, pvd)) - { - label_len = 0; - break; - } + label_len = 0; + break; + } - /* [E] 3/10.1.4 and [U] 2.1.1 */ - if(pvd[24]==8) - { - label_ptr = pvd + 24 + 1; - label_len = pvd[24+32-1]; - break; - } - else - { - unsigned int i; + /* [E] 3/10.1.4 and [U] 2.1.1 */ + if(pvd[24]==8) + { + label_ptr = pvd + 24 + 1; + label_len = pvd[24+32-1]; + break; + } + else + { + unsigned int i; - label_len = 1 + pvd[24+32-1]; - for (i = 0; i < label_len; i += 2) - volume->label[i/2] = (pvd[24+1+i] << 8) | pvd[24+1+i+1]; - volume->label[label_len] = 0; - return; - } + label_len = 1 + pvd[24+32-1]; + for (i = 0; i < label_len; i += 2) + volume->label[i/2] = (pvd[24+1+i] << 8) | pvd[24+1+i+1]; + volume->label[label_len] = 0; + return; } } if (label_len) RtlMultiByteToUnicodeN( volume->label, sizeof(volume->label) - sizeof(WCHAR), -- 2.34.1

1 0

[PATCH] winedbg: Fix disassemble with end addresses exceeding 32-bit.
by Bernhard Übelacker Dec. 18, 2021

Dec. 18, 2021

Signed-off-by: Bernhard Übelacker <bernhardu(a)mailbox.org> --- Otherwise winedbg continues disassembling and does not stop at the desired address. --- programs/winedbg/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/programs/winedbg/memory.c b/programs/winedbg/memory.c index 5e01bef5607..0c8e1ee0d19 100644 --- a/programs/winedbg/memory.c +++ b/programs/winedbg/memory.c @@ -769,7 +769,7 @@ void memory_disassemble(const struct dbg_lvalue* xstart, const struct dbg_lvalue* xend, int instruction_count) { static ADDRESS64 last = {0,0,0}; - int stop = 0; + dbg_lgint_t stop = 0; int i; if (!xstart && !xend) -- 2.34.1

1 0

[PATCH] winealsa.drv: use separate port for each output device.
by Jacek Konieczny Dec. 18, 2021

Dec. 18, 2021

This fixes use of multiple MIDI outputs while keeping the flexibility of proper ALSA sequencer port subscriptions. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52220 Signed-off-by: Jacek Konieczny <jajcus(a)jajcus.net> --- dlls/winealsa.drv/midi.c | 48 ++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 17 deletions(-) diff --git a/dlls/winealsa.drv/midi.c b/dlls/winealsa.drv/midi.c index f2fe6307bb2..e34b5b47b64 100644 --- a/dlls/winealsa.drv/midi.c +++ b/dlls/winealsa.drv/midi.c @@ -85,6 +85,7 @@ typedef struct { void* lpExtra; /* according to port type (MIDI, FM...), extra data when needed */ MIDIOUTCAPSW caps; snd_seq_addr_t addr; + int port_out; } WINE_MIDIOUT; static WINE_MIDIIN MidiInDev [MAX_MIDIINDRV ]; @@ -108,7 +109,6 @@ static int numOpenMidiSeq = 0; static int numStartedMidiIn = 0; static int port_in; -static int port_out; static CRITICAL_SECTION crit_sect; /* protects all MidiIn buffer queues */ static CRITICAL_SECTION_DEBUG critsect_debug = @@ -247,14 +247,6 @@ static int midiOpenSeq(BOOL create_client) /* Setting the client name is the only init to do */ snd_seq_set_client_name(midiSeq, "WINE midi driver"); - port_out = snd_seq_create_simple_port(midiSeq, "WINE ALSA Output", - SND_SEQ_PORT_CAP_READ|SND_SEQ_PORT_CAP_SUBS_READ|SND_SEQ_PORT_CAP_SUBS_WRITE, - SND_SEQ_PORT_TYPE_MIDI_GENERIC|SND_SEQ_PORT_TYPE_APPLICATION); - if (port_out < 0) - TRACE("Unable to create output port\n"); - else - TRACE("Outport port %d created successfully\n", port_out); - port_in = snd_seq_create_simple_port(midiSeq, "WINE ALSA Input", SND_SEQ_PORT_CAP_WRITE|SND_SEQ_PORT_CAP_SUBS_READ|SND_SEQ_PORT_CAP_SUBS_WRITE, SND_SEQ_PORT_TYPE_MIDI_GENERIC|SND_SEQ_PORT_TYPE_APPLICATION); @@ -276,7 +268,6 @@ static int midiCloseSeq(void) { EnterCriticalSection(&midiSeqLock); if (--numOpenMidiSeq == 0) { - snd_seq_delete_simple_port(midiSeq, port_out); snd_seq_delete_simple_port(midiSeq, port_in); snd_seq_close(midiSeq); midiSeq = NULL; @@ -738,6 +729,8 @@ static DWORD modGetDevCaps(WORD wDevID, LPMIDIOUTCAPSW lpCaps, DWORD dwSize) static DWORD modOpen(WORD wDevID, LPMIDIOPENDESC lpDesc, DWORD dwFlags) { int ret; + int port_out; + char port_out_name[32]; TRACE("(%04X, %p, %08X);\n", wDevID, lpDesc, dwFlags); if (lpDesc == NULL) { @@ -784,12 +777,30 @@ static DWORD modOpen(WORD wDevID, LPMIDIOPENDESC lpDesc, DWORD dwFlags) MidiOutDev[wDevID].bufsize = 0x3FFF; MidiOutDev[wDevID].midiDesc = *lpDesc; - /* Connect our app port to the device port */ EnterCriticalSection(&midiSeqLock); - ret = snd_seq_connect_to(midiSeq, port_out, MidiOutDev[wDevID].addr.client, - MidiOutDev[wDevID].addr.port); + /* Create a port dedicated to a specific device */ + /* Keep the old name without a number for the first port */ + if (wDevID) + sprintf(port_out_name, "WINE ALSA Output #%d", wDevID); + + port_out = snd_seq_create_simple_port(midiSeq, wDevID?port_out_name:"WINE ALSA Output", + SND_SEQ_PORT_CAP_READ|SND_SEQ_PORT_CAP_SUBS_READ|SND_SEQ_PORT_CAP_SUBS_WRITE, + SND_SEQ_PORT_TYPE_MIDI_GENERIC|SND_SEQ_PORT_TYPE_APPLICATION); + + if (port_out < 0) { + TRACE("Unable to create output port\n"); + MidiOutDev[wDevID].port_out = -1; + } else { + TRACE("Outport port %d created successfully\n", port_out); + MidiOutDev[wDevID].port_out = port_out; + + /* Connect our app port to the device port */ + ret = snd_seq_connect_to(midiSeq, port_out, MidiOutDev[wDevID].addr.client, + MidiOutDev[wDevID].addr.port); + } LeaveCriticalSection(&midiSeqLock); - if (ret < 0) + + if (port_out < 0 || ret < 0) return MMSYSERR_NOTENABLED; TRACE("Output port :%d connected %d:%d\n",port_out,MidiOutDev[wDevID].addr.client,MidiOutDev[wDevID].addr.port); @@ -825,7 +836,9 @@ static DWORD modClose(WORD wDevID) case MOD_MIDIPORT: case MOD_SYNTH: EnterCriticalSection(&midiSeqLock); - snd_seq_disconnect_to(midiSeq, port_out, MidiOutDev[wDevID].addr.client, MidiOutDev[wDevID].addr.port); + TRACE("Deleting port :%d, connected to %d:%d\n", MidiOutDev[wDevID].port_out, MidiOutDev[wDevID].addr.client, MidiOutDev[wDevID].addr.port); + snd_seq_delete_simple_port(midiSeq, MidiOutDev[wDevID].port_out); + MidiOutDev[wDevID].port_out = -1; LeaveCriticalSection(&midiSeqLock); midiCloseSeq(); break; @@ -870,7 +883,7 @@ static DWORD modData(WORD wDevID, DWORD dwParam) snd_seq_event_t event; snd_seq_ev_clear(&event); snd_seq_ev_set_direct(&event); - snd_seq_ev_set_source(&event, port_out); + snd_seq_ev_set_source(&event, MidiOutDev[wDevID].port_out); snd_seq_ev_set_subs(&event); switch (evt & 0xF0) { @@ -1039,7 +1052,7 @@ static DWORD modLongData(WORD wDevID, LPMIDIHDR lpMidiHdr, DWORD dwSize) } snd_seq_ev_clear(&event); snd_seq_ev_set_direct(&event); - snd_seq_ev_set_source(&event, port_out); + snd_seq_ev_set_source(&event, MidiOutDev[wDevID].port_out); snd_seq_ev_set_subs(&event); snd_seq_ev_set_sysex(&event, lpMidiHdr->dwBufferLength + len_add, lpNewData ? lpNewData : lpData); EnterCriticalSection(&midiSeqLock); @@ -1201,6 +1214,7 @@ static void ALSA_AddMidiPort(snd_seq_client_info_t* cinfo, snd_seq_port_info_t* MidiOutDev[MODM_NumDevs].caps.wNotes = 16; } MidiOutDev[MODM_NumDevs].bEnabled = TRUE; + MidiOutDev[MODM_NumDevs].port_out = -1; TRACE("MidiOut[%d]\tname='%s' techn=%d voices=%d notes=%d chnMsk=%04x support=%d\n" "\tALSA info: midi dev-type=%x, capa=0\n", -- 2.25.1

1 0