- Wine-Devel - list.winehq.org

[PATCH 3/3] winhttp: Consistently validate the buffer in option query functions.
by Hans Leidekker Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/winhttp/session.c | 103 +++++++++++++++++++++-------------------- 1 file changed, 54 insertions(+), 49 deletions(-) diff --git a/dlls/winhttp/session.c b/dlls/winhttp/session.c index 88e305da864..659a1ec8cee 100644 --- a/dlls/winhttp/session.c +++ b/dlls/winhttp/session.c @@ -82,6 +82,17 @@ static void session_destroy( struct object_header *hdr ) free( session ); } +static BOOL validate_buffer( void *buffer, DWORD *buflen, DWORD required ) +{ + if (!buffer || *buflen < required) + { + *buflen = required; + SetLastError( ERROR_INSUFFICIENT_BUFFER ); + return FALSE; + } + return TRUE; +} + static BOOL session_query_option( struct object_header *hdr, DWORD option, void *buffer, DWORD *buflen ) { struct session *session = (struct session *)hdr; @@ -90,38 +101,43 @@ static BOOL session_query_option( struct object_header *hdr, DWORD option, void { case WINHTTP_OPTION_REDIRECT_POLICY: { - if (!buffer || *buflen < sizeof(DWORD)) - { - *buflen = sizeof(DWORD); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; *(DWORD *)buffer = hdr->redirect_policy; *buflen = sizeof(DWORD); return TRUE; } case WINHTTP_OPTION_RESOLVE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = session->resolve_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_CONNECT_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = session->connect_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_SEND_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = session->send_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_RECEIVE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = session->receive_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_RECEIVE_RESPONSE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = session->receive_response_timeout; *buflen = sizeof(DWORD); return TRUE; @@ -314,38 +330,43 @@ static BOOL connect_query_option( struct object_header *hdr, DWORD option, void { case WINHTTP_OPTION_PARENT_HANDLE: { - if (!buffer || *buflen < sizeof(HINTERNET)) - { - *buflen = sizeof(HINTERNET); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } + if (!validate_buffer( buffer, buflen, sizeof(HINTERNET) )) return FALSE; *(HINTERNET *)buffer = ((struct object_header *)connect->session)->handle; *buflen = sizeof(HINTERNET); return TRUE; } case WINHTTP_OPTION_RESOLVE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = connect->session->resolve_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_CONNECT_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = connect->session->connect_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_SEND_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = connect->session->send_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_RECEIVE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = connect->session->receive_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_RECEIVE_RESPONSE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = connect->session->receive_response_timeout; *buflen = sizeof(DWORD); return TRUE; @@ -669,12 +690,7 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void DWORD flags; int bits; - if (!buffer || *buflen < sizeof(flags)) - { - *buflen = sizeof(flags); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } + if (!validate_buffer( buffer, buflen, sizeof(flags) )) return FALSE; flags = request->security_flags; if (request->netconn) @@ -695,12 +711,7 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void { const CERT_CONTEXT *cert; - if (!buffer || *buflen < sizeof(cert)) - { - *buflen = sizeof(cert); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } + if (!validate_buffer( buffer, buflen, sizeof(cert) )) return FALSE; if (!(cert = CertDuplicateCertificateContext( request->server_cert ))) return FALSE; *(CERT_CONTEXT **)buffer = (CERT_CONTEXT *)cert; @@ -715,13 +726,7 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void FIXME("partial stub\n"); - if (!buffer || *buflen < sizeof(*ci)) - { - *buflen = sizeof(*ci); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } - if (!cert) return FALSE; + if (!validate_buffer( buffer, buflen, sizeof(*ci) ) || !cert) return FALSE; ci->ftExpiry = cert->pCertInfo->NotAfter; ci->ftStart = cert->pCertInfo->NotBefore; @@ -741,12 +746,7 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void } case WINHTTP_OPTION_SECURITY_KEY_BITNESS: { - if (!buffer || *buflen < sizeof(DWORD)) - { - *buflen = sizeof(DWORD); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; *(DWORD *)buffer = request->netconn ? netconn_get_cipher_strength( request->netconn ) : 0; *buflen = sizeof(DWORD); @@ -759,12 +759,8 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void socklen_t len = sizeof(local); const struct sockaddr *remote = (const struct sockaddr *)&request->connect->sockaddr; - if (!buffer || *buflen < sizeof(*info)) - { - *buflen = sizeof(*info); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } + if (!validate_buffer( buffer, buflen, sizeof(*info) )) return FALSE; + if (!request->netconn) { SetLastError( ERROR_WINHTTP_INCORRECT_HANDLE_STATE ); @@ -777,26 +773,36 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void return TRUE; } case WINHTTP_OPTION_RESOLVE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = request->resolve_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_CONNECT_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = request->connect_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_SEND_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = request->send_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_RECEIVE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = request->receive_timeout; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_RECEIVE_RESPONSE_TIMEOUT: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = request->receive_response_timeout; *buflen = sizeof(DWORD); return TRUE; @@ -818,11 +824,15 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void return TRUE; case WINHTTP_OPTION_MAX_HTTP_AUTOMATIC_REDIRECTS: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + *(DWORD *)buffer = request->max_redirects; *buflen = sizeof(DWORD); return TRUE; case WINHTTP_OPTION_HTTP_PROTOCOL_USED: + if (!validate_buffer( buffer, buflen, sizeof(DWORD) )) return FALSE; + FIXME("WINHTTP_OPTION_HTTP_PROTOCOL_USED\n"); *(DWORD *)buffer = 0; *buflen = sizeof(DWORD); @@ -1214,12 +1224,7 @@ static BOOL query_option( struct object_header *hdr, DWORD option, void *buffer, { case WINHTTP_OPTION_CONTEXT_VALUE: { - if (!buffer || *buflen < sizeof(DWORD_PTR)) - { - *buflen = sizeof(DWORD_PTR); - SetLastError( ERROR_INSUFFICIENT_BUFFER ); - return FALSE; - } + if (!validate_buffer( buffer, buflen, sizeof(DWORD_PTR) )) return FALSE; *(DWORD_PTR *)buffer = hdr->context; *buflen = sizeof(DWORD_PTR); -- 2.30.2

1 0

[PATCH 2/3] winhttp: Add a stub for WinHttpQueryOption(WINHTTP_OPTION_HTTP_PROTOCOL_USED).
by Hans Leidekker Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/winhttp/session.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dlls/winhttp/session.c b/dlls/winhttp/session.c index b9635b8933f..88e305da864 100644 --- a/dlls/winhttp/session.c +++ b/dlls/winhttp/session.c @@ -822,6 +822,12 @@ static BOOL request_query_option( struct object_header *hdr, DWORD option, void *buflen = sizeof(DWORD); return TRUE; + case WINHTTP_OPTION_HTTP_PROTOCOL_USED: + FIXME("WINHTTP_OPTION_HTTP_PROTOCOL_USED\n"); + *(DWORD *)buffer = 0; + *buflen = sizeof(DWORD); + return TRUE; + default: FIXME("unimplemented option %u\n", option); SetLastError( ERROR_INVALID_PARAMETER ); -- 2.30.2

1 0

[PATCH 1/3] winhttp: Add a stub for WinHttpSetOption(WINHTTP_OPTION_ENABLE_HTTP_PROTOCOL).
by Hans Leidekker Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Hans Leidekker <hans(a)codeweavers.com> --- dlls/winhttp/session.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/dlls/winhttp/session.c b/dlls/winhttp/session.c index e4e8f1cec56..b9635b8933f 100644 --- a/dlls/winhttp/session.c +++ b/dlls/winhttp/session.c @@ -1049,6 +1049,15 @@ static BOOL request_set_option( struct object_header *hdr, DWORD option, void *b FIXME("WINHTTP_OPTION_MAX_RESPONSE_DRAIN_SIZE\n"); return TRUE; + case WINHTTP_OPTION_ENABLE_HTTP_PROTOCOL: + if (buflen == sizeof(DWORD)) + { + FIXME("WINHTTP_OPTION_ENABLE_HTTP_PROTOCOL %08x\n", *(DWORD *)buffer); + return TRUE; + } + SetLastError(ERROR_INVALID_PARAMETER); + return FALSE; + default: FIXME("unimplemented option %u\n", option); SetLastError( ERROR_WINHTTP_INVALID_OPTION ); -- 2.30.2

1 0

[PATCH 5/5] gdi32: Directly call dib driver functions in dibdrv_wglCreateContext.
by Jacek Caban Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/gdi32/dibdrv/dc.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)

2 1

[PATCH 4/5] gdi32: Directly use ntdll in dib.c.
by Jacek Caban Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/gdi32/dib.c | 49 +++++++++++++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 19 deletions(-)

2 1

[PATCH 3/5] gdi32: Use NtQuerySystemInformation instead of GetSystemInfo.
by Jacek Caban Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/gdi32/dib.c | 8 ++------ dlls/gdi32/gdiobj.c | 2 ++ dlls/gdi32/ntgdi_private.h | 1 + 3 files changed, 5 insertions(+), 6 deletions(-)

2 1

[PATCH 2/5] gdi32: Avoid calling gdi32 functions from ntgdi functions.
by Jacek Caban Sept. 17, 2021

Sept. 17, 2021

2 1

[PATCH 1/5] gdi32: Access stretch mode directly from DC in NtGdiTransparentBlt.
by Jacek Caban Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com> --- dlls/gdi32/bitblt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)

2 1

[PATCH vkd3d] vkd3d-shader: Factor out a vkd3d_shader_trace_text() helper and use it in vkd3d_spirv_dump() (Valgrind).
by Zebediah Figura Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Zebediah Figura <zfigura(a)codeweavers.com> --- libs/vkd3d-shader/spirv.c | 8 +------- libs/vkd3d-shader/vkd3d_shader_main.c | 9 +++++++-- libs/vkd3d-shader/vkd3d_shader_private.h | 3 +++ 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/libs/vkd3d-shader/spirv.c b/libs/vkd3d-shader/spirv.c index 6f948c31c..f604b8efd 100644 --- a/libs/vkd3d-shader/spirv.c +++ b/libs/vkd3d-shader/spirv.c @@ -127,13 +127,7 @@ static void vkd3d_spirv_dump(const struct vkd3d_shader_code *spirv, if (!vkd3d_spirv_binary_to_text(spirv, environment, options, &text)) { - const char *str, *current = text.code; - while ((str = strchr(current, '\n'))) - { - TRACE("%.*s\n", (int)(str - current), current); - current = str + 1; - } - + vkd3d_shader_trace_text(text.code, text.size); vkd3d_shader_free_shader_code(&text); } } diff --git a/libs/vkd3d-shader/vkd3d_shader_main.c b/libs/vkd3d-shader/vkd3d_shader_main.c index 5d7cdf019..e38261b45 100644 --- a/libs/vkd3d-shader/vkd3d_shader_main.c +++ b/libs/vkd3d-shader/vkd3d_shader_main.c @@ -98,12 +98,17 @@ int vkd3d_string_buffer_printf(struct vkd3d_string_buffer *buffer, const char *f void vkd3d_string_buffer_trace_(const struct vkd3d_string_buffer *buffer, const char *function) { - const char *p, *q, *end = buffer->buffer + buffer->content_size; + vkd3d_shader_trace_text_(buffer->buffer, buffer->content_size, function); +} + +void vkd3d_shader_trace_text_(const char *text, size_t size, const char *function) +{ + const char *p, *q, *end = text + size; if (!TRACE_ON()) return; - for (p = buffer->buffer; p < end; p = q) + for (p = text; p < end; p = q) { if (!(q = memchr(p, '\n', end - p))) q = end; diff --git a/libs/vkd3d-shader/vkd3d_shader_private.h b/libs/vkd3d-shader/vkd3d_shader_private.h index 5ced3d532..78354a95b 100644 --- a/libs/vkd3d-shader/vkd3d_shader_private.h +++ b/libs/vkd3d-shader/vkd3d_shader_private.h @@ -988,6 +988,9 @@ void vkd3d_shader_vwarning(struct vkd3d_shader_message_context *context, const s void vkd3d_shader_dump_shader(enum vkd3d_shader_source_type source_type, enum vkd3d_shader_type shader_type, const struct vkd3d_shader_code *shader); +void vkd3d_shader_trace_text_(const char *text, size_t size, const char *function); +#define vkd3d_shader_trace_text(text, size) \ + vkd3d_shader_trace_text_(text, size, __FUNCTION__) int shader_extract_from_dxbc(const void *dxbc, size_t dxbc_length, struct vkd3d_shader_message_context *message_context, const char *source_name, struct vkd3d_shader_desc *desc); -- 2.33.0

2 1

[PATCH vkd3d 1/6] vkd3d-shader/hlsl: Write SM1 max instructions.
by Zebediah Figura Sept. 17, 2021

Sept. 17, 2021

Signed-off-by: Zebediah Figura <zfigura(a)codeweavers.com> --- libs/vkd3d-shader/hlsl_sm1.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libs/vkd3d-shader/hlsl_sm1.c b/libs/vkd3d-shader/hlsl_sm1.c index b9a681a45..d56b6894a 100644 --- a/libs/vkd3d-shader/hlsl_sm1.c +++ b/libs/vkd3d-shader/hlsl_sm1.c @@ -632,6 +632,10 @@ static void write_sm1_expr(struct hlsl_ctx *ctx, struct vkd3d_bytecode_buffer *b write_sm1_binary_op(ctx, buffer, D3DSIO_ADD, &instr->reg, &arg1->reg, &arg2->reg); break; + case HLSL_OP2_MAX: + write_sm1_binary_op(ctx, buffer, D3DSIO_MAX, &instr->reg, &arg1->reg, &arg2->reg); + break; + case HLSL_OP2_MUL: write_sm1_binary_op(ctx, buffer, D3DSIO_MUL, &instr->reg, &arg1->reg, &arg2->reg); break; -- 2.33.0

5 24