[PATCH v3 1/1] mmdevapi: Avoid copying more memory than reserved in validate_fmt (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker <[e-mail]>

Co-authored-by: Giovanni Mascellani <[e-mail]>
---
 dlls/mmdevapi/client.c       | 16 +++++++++++-----
 dlls/mmdevapi/tests/render.c | 16 +++++++++++-----
 dlls/winmm/tests/wave.c      | 15 ++++++++++-----
 3 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/dlls/mmdevapi/client.c b/dlls/mmdevapi/client.c
index 4c23905aad8..d7e05a68215 100644
--- a/dlls/mmdevapi/client.c
+++ b/dlls/mmdevapi/client.c
@@ -360,12 +360,14 @@ skip:
 
 HRESULT validate_fmt(const WAVEFORMATEXTENSIBLE *fmt, BOOL compatible)
 {
-    WAVEFORMATEXTENSIBLE fmt2 = *fmt;
+    WAVEFORMATEXTENSIBLE fmt2;
     HRESULT ret;
 
     /* Reduce non-extensible formats to extensible ones. */
-    if (fmt2.Format.wFormatTag != WAVE_FORMAT_EXTENSIBLE)
+    if (fmt->Format.wFormatTag != WAVE_FORMAT_EXTENSIBLE)
     {
+        fmt2.Format = fmt->Format;
+
         switch (fmt2.Format.wFormatTag)
         {
             case WAVE_FORMAT_PCM: fmt2.SubFormat = KSDATAFORMAT_SUBTYPE_PCM; break;
@@ -380,10 +382,14 @@ HRESULT validate_fmt(const WAVEFORMATEXTENSIBLE *fmt, BOOL compatible)
         fmt2.Samples.wValidBitsPerSample = fmt2.Format.wBitsPerSample;
         fmt2.Format.cbSize = sizeof(fmt2) - sizeof(fmt2.Format);
     }
+    else
+    {
+        if (fmt->Format.cbSize < sizeof(fmt2) - sizeof(fmt2.Format))
+            return E_INVALIDARG;
+        fmt2 = *fmt;
+    }
 
-    if (fmt2.Format.cbSize < sizeof(fmt2) - sizeof(fmt2.Format))
-        ret = E_INVALIDARG;
-    else if (fmt2.Format.nChannels == 0 || fmt2.Format.nSamplesPerSec == 0)
+    if (fmt2.Format.nChannels == 0 || fmt2.Format.nSamplesPerSec == 0)
         ret = E_INVALIDARG;
     else if (fmt2.Format.nBlockAlign != fmt2.Format.nChannels * fmt2.Format.wBitsPerSample / 8)
         ret = E_INVALIDARG;
diff --git a/dlls/mmdevapi/tests/render.c b/dlls/mmdevapi/tests/render.c
index 6fa1465a5f3..192ef180139 100644
--- a/dlls/mmdevapi/tests/render.c
+++ b/dlls/mmdevapi/tests/render.c
@@ -790,12 +790,14 @@ void fill_wave_formats(const WAVEFORMATEXTENSIBLE *base_fmt)
 /* Identical to dlls/mmdevapi/client.c. */
 HRESULT validate_fmt(const WAVEFORMATEXTENSIBLE *fmt, BOOL compatible)
 {
-    WAVEFORMATEXTENSIBLE fmt2 = *fmt;
+    WAVEFORMATEXTENSIBLE fmt2;
     HRESULT ret;
 
     /* Reduce non-extensible formats to extensible ones. */
-    if (fmt2.Format.wFormatTag != WAVE_FORMAT_EXTENSIBLE)
+    if (fmt->Format.wFormatTag != WAVE_FORMAT_EXTENSIBLE)
     {
+        fmt2.Format = fmt->Format;
+
         switch (fmt2.Format.wFormatTag)
         {
             case WAVE_FORMAT_PCM: fmt2.SubFormat = KSDATAFORMAT_SUBTYPE_PCM; break;
@@ -810,10 +812,14 @@ HRESULT validate_fmt(const WAVEFORMATEXTENSIBLE *fmt, BOOL compatible)
         fmt2.Samples.wValidBitsPerSample = fmt2.Format.wBitsPerSample;
         fmt2.Format.cbSize = sizeof(fmt2) - sizeof(fmt2.Format);
     }
+    else
+    {
+        if (fmt->Format.cbSize < sizeof(fmt2) - sizeof(fmt2.Format))
+            return E_INVALIDARG;
+        fmt2 = *fmt;
+    }
 
-    if (fmt2.Format.cbSize < sizeof(fmt2) - sizeof(fmt2.Format))
-        ret = E_INVALIDARG;
-    else if (fmt2.Format.nChannels == 0 || fmt2.Format.nSamplesPerSec == 0)
+    if (fmt2.Format.nChannels == 0 || fmt2.Format.nSamplesPerSec == 0)
         ret = E_INVALIDARG;
     else if (fmt2.Format.nBlockAlign != fmt2.Format.nChannels * fmt2.Format.wBitsPerSample / 8)
         ret = E_INVALIDARG;
diff --git a/dlls/winmm/tests/wave.c b/dlls/winmm/tests/wave.c
index b0b7a6a3123..38f0c705e08 100644
--- a/dlls/winmm/tests/wave.c
+++ b/dlls/winmm/tests/wave.c
@@ -1901,13 +1901,14 @@ static void test_PlaySound(void)
 
 static MMRESULT validate_fmt(const WAVEFORMATEXTENSIBLE *fmt, BOOL direct)
 {
-    WAVEFORMATEXTENSIBLE fmt2 = *fmt;
+    WAVEFORMATEXTENSIBLE fmt2;
     BOOL extensible = TRUE;
     MMRESULT ret;
 
     /* Reduce non-extensible formats to extensible ones. */
-    if (fmt2.Format.wFormatTag != WAVE_FORMAT_EXTENSIBLE)
+    if (fmt->Format.wFormatTag != WAVE_FORMAT_EXTENSIBLE)
     {
+        fmt2.Format = fmt->Format;
         extensible = FALSE;
 
         switch (fmt2.Format.wFormatTag)
@@ -1926,10 +1927,14 @@ static MMRESULT validate_fmt(const WAVEFORMATEXTENSIBLE *fmt, BOOL direct)
         fmt2.Samples.wValidBitsPerSample = fmt2.Format.wBitsPerSample;
         fmt2.Format.cbSize = sizeof(fmt2) - sizeof(fmt2.Format);
     }
+    else
+    {
+        if (fmt->Format.cbSize < sizeof(fmt2) - sizeof(fmt2.Format))
+            return E_INVALIDARG;
+        fmt2 = *fmt;
+    }
 
-    if (fmt2.Format.cbSize < sizeof(fmt2) - sizeof(fmt2.Format))
-        ret = direct ? MMSYSERR_INVALPARAM : WAVERR_BADFORMAT;
-    else if ((fmt2.Format.nChannels == 0) || fmt2.Format.nSamplesPerSec == 0)
+    if ((fmt2.Format.nChannels == 0) || fmt2.Format.nSamplesPerSec == 0)
         ret = WAVERR_BADFORMAT;
     else if (fmt2.Format.nBlockAlign != fmt2.Format.nChannels * fmt2.Format.wBitsPerSample / 8)
         ret = WAVERR_BADFORMAT;
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/10326