[PATCH] msscript.ocx: Avoid buffer overflow when getting the type info.

[Gabriel Ivăncescu]

Signed-off-by: Gabriel Ivăncescu <gabrielopcode(a)gmail.com>
---
 dlls/msscript.ocx/msscript.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dlls/msscript.ocx/msscript.c b/dlls/msscript.ocx/msscript.c
index 6e4c8d1..8fdcf20 100644
--- a/dlls/msscript.ocx/msscript.c
+++ b/dlls/msscript.ocx/msscript.c
@@ -139,6 +139,8 @@ static HRESULT get_typeinfo(tid_t tid, ITypeInfo **typeinfo)
 {
     HRESULT hres;
 
+    if (tid >= ARRAY_SIZE(typeinfos))
+        return DISP_E_BADINDEX;
     if (!typelib)
         hres = load_typelib();
     if (!typelib)
-- 
2.21.0

[Jacek Caban]

Hi Gabriel,

On 9/23/19 2:53 PM, Gabriel Ivăncescu wrote:
> @@ -139,6 +139,8 @@ static HRESULT get_typeinfo(tid_t tid, ITypeInfo **typeinfo)
>   {
>       HRESULT hres;
>
> +    if (tid >= ARRAY_SIZE(typeinfos))
> +        return DISP_E_BADINDEX;

This is an internal function, so invalid tid should never happen.


Jacek

[Gabriel Ivăncescu]

On 9/23/19 4:03 PM, Jacek Caban wrote:
> Hi Gabriel,
>
> On 9/23/19 2:53 PM, Gabriel Ivăncescu wrote:
> > @@ -139,6 +139,8 @@ static HRESULT get_typeinfo(tid_t tid, ITypeInfo 
> > **typeinfo)
> >   {
> >       HRESULT hres;
> > +    if (tid >= ARRAY_SIZE(typeinfos))
> > +        return DISP_E_BADINDEX;
>
> This is an internal function, so invalid tid should never happen.
>
> Jacek

Hi Jacek,

Unless I'm misunderstanding something, it's called from GetTypeInfo, 
GetIDsOfNames, Invoke, without any checking on the input. I didn't want 
to duplicate the checks in each of them, though.

[Jacek Caban]

On 9/23/19 3:14 PM, Gabriel Ivăncescu wrote:
> > This is an internal function, so invalid tid should never happen.
>
> Hi Jacek,
>
> Unless I'm misunderstanding something, it's called from GetTypeInfo, 
> GetIDsOfNames, Invoke, without any checking on the input. I didn't 
> want to duplicate the checks in each of them, though.

It always passes IScriptConteol_tid constant as tid.


Jacek

[Gabriel Ivăncescu]

On 9/23/19 4:25 PM, Jacek Caban wrote:
> On 9/23/19 3:14 PM, Gabriel Ivăncescu wrote:
> > > This is an internal function, so invalid tid should never happen.
> >
> > Hi Jacek,
> >
> > Unless I'm misunderstanding something, it's called from GetTypeInfo, 
> > GetIDsOfNames, Invoke, without any checking on the input. I didn't 
> > want to duplicate the checks in each of them, though.
>
> It always passes IScriptConteol_tid constant as tid.
>
> Jacek

Right, sorry for the noise, I completely missed that fact. :-)