[PATCH 0/4] MR1877: user32: Clipboard overflow and underflow fixes
From: Francois Gouget <fgouget(a)codeweavers.com> This has the benefit of indicating why GetClipboardData() failed and of matching the Windows 11 behavior. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54190 --- dlls/user32/tests/clipboard.c | 8 ++++++-- dlls/win32u/clipboard.c | 6 +++++- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/dlls/user32/tests/clipboard.c b/dlls/user32/tests/clipboard.c index 3131c2e0e8c..7414af996fb 100644 --- a/dlls/user32/tests/clipboard.c +++ b/dlls/user32/tests/clipboard.c @@ -986,7 +986,9 @@ static void test_synthesized(void) SetLastError(0xdeadbeef); data = GetClipboardData( CF_TEXT ); - ok(GetLastError() == 0xdeadbeef, "bad last error %ld\n", GetLastError()); + ok(GetLastError() == ERROR_NOT_FOUND /* win11 */ || + broken(GetLastError() == 0xdeadbeef), + "bad last error %ld\n", GetLastError()); ok(!data, "GetClipboardData() should have returned NULL\n"); r = CloseClipboard(); @@ -1587,7 +1589,9 @@ static void test_handles( HWND hwnd ) SetLastError( 0xdeadbeef ); data = GetClipboardData( CF_RIFF ); - ok( GetLastError() == 0xdeadbeef, "unexpected last error %ld\n", GetLastError() ); + ok( GetLastError() == ERROR_NOT_FOUND /* win11 */ || + broken(GetLastError() == 0xdeadbeef), + "unexpected last error %ld\n", GetLastError() ); ok( !data, "wrong data %p\n", data ); h = SetClipboardData( CF_PRIVATEFIRST + 7, htext4 ); diff --git a/dlls/win32u/clipboard.c b/dlls/win32u/clipboard.c index d53cd966d36..6cf484a56ca 100644 --- a/dlls/win32u/clipboard.c +++ b/dlls/win32u/clipboard.c @@ -720,7 +720,11 @@ HANDLE WINAPI NtUserGetClipboardData( UINT format, struct get_clipboard_params * params->data_size = size; return 0; } - if (status == STATUS_OBJECT_NAME_NOT_FOUND) return 0; /* no such format */ + if (status == STATUS_OBJECT_NAME_NOT_FOUND) + { + RtlSetLastWin32Error( ERROR_NOT_FOUND ); /* no such format */ + return 0; + } if (status) { RtlSetLastWin32Error( RtlNtStatusToDosError( status )); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/1877
From: Francois Gouget <fgouget(a)codeweavers.com> Using wine_dbgstr_wn() causes out-of-bounds memory accesses when given Unicode strings with odd sizes, most obviously 1 byte strings. Also trace the expected Ansi string for round-trip tests. --- dlls/user32/tests/clipboard.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dlls/user32/tests/clipboard.c b/dlls/user32/tests/clipboard.c index 7414af996fb..09f01b7481a 100644 --- a/dlls/user32/tests/clipboard.c +++ b/dlls/user32/tests/clipboard.c @@ -2269,7 +2269,7 @@ static void test_string_data(void) memcpy( bufferW, test_data[i].strW, test_data[i].len ); bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; ok( !memcmp( data, bufferW, test_data[i].len ), - "wrong data %s\n", wine_dbgstr_wn( data, (test_data[i].len + 1) / sizeof(WCHAR) )); + "wrong data %s\n", wine_dbgstr_an( data, test_data[i].len )); } r = CloseClipboard(); ok( r, "gle %ld\n", GetLastError() ); @@ -2314,8 +2314,7 @@ static void test_string_data_process( int i ) ok( len == test_data[i].len, "wrong size %u / %u\n", len, test_data[i].len ); memcpy( bufferW, test_data[i].strW, test_data[i].len ); bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; - ok( !memcmp( data, bufferW, len ), - "wrong data %s\n", wine_dbgstr_wn( data, (len + 1) / sizeof(WCHAR) )); + ok( !memcmp( data, bufferW, len ), "wrong data %s\n", wine_dbgstr_an( data, len )); data = GetClipboardData( CF_TEXT ); if (test_data[i].len >= sizeof(WCHAR)) { @@ -2325,7 +2324,8 @@ static void test_string_data_process( int i ) bufferA, ARRAY_SIZE(bufferA), NULL, NULL ); bufferA[len2 - 1] = 0; ok( len == len2, "wrong size %u / %u\n", len, len2 ); - ok( !memcmp( data, bufferA, len ), "wrong data %.*s\n", len, (char *)data ); + ok( !memcmp( data, bufferA, len ), "wrong data %s, expected %s\n", + wine_dbgstr_an( data, len ), wine_dbgstr_an( bufferA, len2 )); } else { -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/1877
From: Francois Gouget <fgouget(a)codeweavers.com> A 0 or 1 byte Unicode string cannot be NUL terminated. That does stop Windows 10 and older from doing so which is why the 1 byte test must be skipped to avoid a crash in the 64-bit case. But in such cases SetClipboardData() fails on Windows 11 and so should Wine (instead of underflowing the buffer like Windows). Reorganize the test data by increasing size. Wine-Bugs: https://bugs.winehq.org/show_bug.cgi?id=54192 --- dlls/user32/clipboard.c | 1 + dlls/user32/tests/clipboard.c | 73 ++++++++++++++++++++++++----------- 2 files changed, 51 insertions(+), 23 deletions(-) diff --git a/dlls/user32/clipboard.c b/dlls/user32/clipboard.c index dd33bd7df82..f006e205e05 100644 --- a/dlls/user32/clipboard.c +++ b/dlls/user32/clipboard.c @@ -160,6 +160,7 @@ static HANDLE marshal_data( UINT format, HANDLE handle, size_t *ret_size ) WCHAR *ptr; if (!(size = GlobalSize( handle ))) return 0; if ((data_size_t)size != size) return 0; + if (size < sizeof(WCHAR)) return 0; if (!(ptr = GlobalLock( handle ))) return 0; ptr[(size + 1) / sizeof(WCHAR) - 1] = 0; /* enforce null-termination */ GlobalUnlock( handle ); diff --git a/dlls/user32/tests/clipboard.c b/dlls/user32/tests/clipboard.c index 09f01b7481a..38249c24ea0 100644 --- a/dlls/user32/tests/clipboard.c +++ b/dlls/user32/tests/clipboard.c @@ -2217,35 +2217,39 @@ static const struct UINT len; } test_data[] = { - { "foo", {}, 3 }, /* 0 */ + { "foo", {}, 3 }, /* 0 */ { "foo", {}, 4 }, { "foo\0bar", {}, 7 }, { "foo\0bar", {}, 8 }, - { "", {'f','o','o'}, 3 * sizeof(WCHAR) }, - { "", {'f','o','o',0}, 4 * sizeof(WCHAR) }, /* 5 */ + { "", {}, 0 }, + { "", {'f'}, 1 }, /* 5 */ + { "", {'f'}, 2 }, + { "", {'f','o','o'}, 5 }, + { "", {'f','o','o'}, 6 }, + { "", {'f','o','o',0}, 7 }, /* 10 */ + { "", {'f','o','o',0}, 8 }, + { "", {'f','o','o',0,'b'}, 9 }, { "", {'f','o','o',0,'b','a','r'}, 7 * sizeof(WCHAR) }, { "", {'f','o','o',0,'b','a','r',0}, 8 * sizeof(WCHAR) }, - { "", {'f','o','o'}, 1 }, - { "", {'f','o','o'}, 2 }, - { "", {'f','o','o'}, 5 }, /* 10 */ - { "", {'f','o','o',0}, 7 }, - { "", {'f','o','o',0}, 9 }, }; static void test_string_data(void) { UINT i; BOOL r; - HANDLE data; + HANDLE data, clip; char cmd[16]; char bufferA[12]; WCHAR bufferW[12]; for (i = 0; i < ARRAY_SIZE(test_data); i++) { - /* 1-byte Unicode strings crash on Win64 */ #ifdef _WIN64 - if (!test_data[i].strA[0] && test_data[i].len < sizeof(WCHAR)) continue; + /* Before Windows 11 1-byte Unicode strings crash on Win64 + * because it underflows when 'appending' a 2 bytes NUL character! + */ + if (!test_data[i].strA[0] && test_data[i].len < sizeof(WCHAR) && + strcmp(winetest_platform, "windows") == 0) continue; #endif winetest_push_context("%d", i); r = open_clipboard( 0 ); @@ -2265,11 +2269,17 @@ static void test_string_data(void) else { memcpy( data, test_data[i].strW, test_data[i].len ); - SetClipboardData( CF_UNICODETEXT, data ); - memcpy( bufferW, test_data[i].strW, test_data[i].len ); - bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; - ok( !memcmp( data, bufferW, test_data[i].len ), - "wrong data %s\n", wine_dbgstr_an( data, test_data[i].len )); + clip = SetClipboardData( CF_UNICODETEXT, data ); + if (test_data[i].len >= sizeof(WCHAR)) + { + ok( clip == data, "SetClipboardData() returned %p != %p\n", clip, data ); + memcpy( bufferW, test_data[i].strW, test_data[i].len ); + bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; + ok( !memcmp( data, bufferW, test_data[i].len ), + "wrong data %s\n", wine_dbgstr_an( data, test_data[i].len )); + } + else + ok( !clip || broken(clip != NULL), "expected SetClipboardData() to fail\n" ); } r = CloseClipboard(); ok( r, "gle %ld\n", GetLastError() ); @@ -2309,12 +2319,27 @@ static void test_string_data_process( int i ) else { data = GetClipboardData( CF_UNICODETEXT ); - ok( data != 0, "could not get data\n" ); - len = GlobalSize( data ); - ok( len == test_data[i].len, "wrong size %u / %u\n", len, test_data[i].len ); - memcpy( bufferW, test_data[i].strW, test_data[i].len ); - bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; - ok( !memcmp( data, bufferW, len ), "wrong data %s\n", wine_dbgstr_an( data, len )); + if (!data) + { + ok( test_data[i].len < sizeof(WCHAR), "got no data for len=%d\n", test_data[i].len ); + ok( !IsClipboardFormatAvailable( CF_UNICODETEXT ), "unicode available\n" ); + } + else if (test_data[i].len == 0) + { + /* 0-byte string handling is broken on Windows <= 10 */ + len = GlobalSize( data ); + ok( broken(len == 1), "wrong size %u / 0\n", len ); + ok( broken(*((char*)data) == 0), "wrong data %s\n", wine_dbgstr_an( data, len )); + } + else + { + len = GlobalSize( data ); + ok( len == test_data[i].len, "wrong size %u / %u\n", len, test_data[i].len ); + memcpy( bufferW, test_data[i].strW, test_data[i].len ); + bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; + ok( !memcmp( data, bufferW, len ), "wrong data %s\n", wine_dbgstr_an( data, len )); + } + data = GetClipboardData( CF_TEXT ); if (test_data[i].len >= sizeof(WCHAR)) { @@ -2329,8 +2354,10 @@ static void test_string_data_process( int i ) } else { + BOOL available = IsClipboardFormatAvailable( CF_TEXT ); + ok( !available || broken(available /* win10 */), + "available text %d\n", available ); ok( !data, "got data for empty string\n" ); - ok( IsClipboardFormatAvailable( CF_TEXT ), "text not available\n" ); } } r = CloseClipboard(); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/1877
From: Francois Gouget <fgouget(a)codeweavers.com> Wine would append a correctly aligned NUL Unicode character to terminate the string but overflow the buffer by one byte for odd-sized strings. Windows instead overwrites the last two buffer bytes with a NUL Unicode character which ends up being misaligned for odd-sized strings. The clipboard data has a size field anyway so match the Windows behavior. Tweak the tests to show that SetClipboardData() can overwrite half of the Unicode string's last character. --- dlls/user32/clipboard.c | 5 +++-- dlls/user32/tests/clipboard.c | 14 +++++++------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/dlls/user32/clipboard.c b/dlls/user32/clipboard.c index f006e205e05..c88394f41a9 100644 --- a/dlls/user32/clipboard.c +++ b/dlls/user32/clipboard.c @@ -157,12 +157,13 @@ static HANDLE marshal_data( UINT format, HANDLE handle, size_t *ret_size ) } case CF_UNICODETEXT: { - WCHAR *ptr; + char *ptr; if (!(size = GlobalSize( handle ))) return 0; if ((data_size_t)size != size) return 0; if (size < sizeof(WCHAR)) return 0; if (!(ptr = GlobalLock( handle ))) return 0; - ptr[(size + 1) / sizeof(WCHAR) - 1] = 0; /* enforce null-termination */ + /* enforce nul-termination the Windows way: ignoring alignment */ + *((WCHAR*)(ptr + size - 2)) = 0; GlobalUnlock( handle ); *ret_size = size; return handle; diff --git a/dlls/user32/tests/clipboard.c b/dlls/user32/tests/clipboard.c index 38249c24ea0..eb70d41ab1c 100644 --- a/dlls/user32/tests/clipboard.c +++ b/dlls/user32/tests/clipboard.c @@ -2224,11 +2224,11 @@ static const struct { "", {}, 0 }, { "", {'f'}, 1 }, /* 5 */ { "", {'f'}, 2 }, - { "", {'f','o','o'}, 5 }, - { "", {'f','o','o'}, 6 }, - { "", {'f','o','o',0}, 7 }, /* 10 */ - { "", {'f','o','o',0}, 8 }, - { "", {'f','o','o',0,'b'}, 9 }, + { "", {0x3b1,0x3b2,0x3b3}, 5 }, /* Alpha, beta, ... */ + { "", {0x3b1,0x3b2,0x3b3}, 6 }, + { "", {0x3b1,0x3b2,0x3b3,0}, 7 }, /* 10 */ + { "", {0x3b1,0x3b2,0x3b3,0}, 8 }, + { "", {0x3b1,0x3b2,0x3b3,0,0x3b4}, 9 }, { "", {'f','o','o',0,'b','a','r'}, 7 * sizeof(WCHAR) }, { "", {'f','o','o',0,'b','a','r',0}, 8 * sizeof(WCHAR) }, }; @@ -2274,7 +2274,7 @@ static void test_string_data(void) { ok( clip == data, "SetClipboardData() returned %p != %p\n", clip, data ); memcpy( bufferW, test_data[i].strW, test_data[i].len ); - bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; + *((WCHAR*)(((char*)bufferW) + test_data[i].len - 2)) = 0; ok( !memcmp( data, bufferW, test_data[i].len ), "wrong data %s\n", wine_dbgstr_an( data, test_data[i].len )); } @@ -2336,7 +2336,7 @@ static void test_string_data_process( int i ) len = GlobalSize( data ); ok( len == test_data[i].len, "wrong size %u / %u\n", len, test_data[i].len ); memcpy( bufferW, test_data[i].strW, test_data[i].len ); - bufferW[(test_data[i].len + 1) / sizeof(WCHAR) - 1] = 0; + *((WCHAR*)(((char*)bufferW) + test_data[i].len - 2)) = 0; ok( !memcmp( data, bufferW, len ), "wrong data %s\n", wine_dbgstr_an( data, len )); } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/1877
The GitLab CI (#6095) failure is caused by the pre-existing ntdll:threadpool bug 54064. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/1877#note_20082
participants (2)
-
Francois Gouget -
Francois Gouget (＠fgouget)