[PATCH 0/1] MR11325: winspool: Avoid overflow because the size is insufficient.

[Haoyang Chen (＠chenhaoyang)]

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11325

[PATCH 1/1] winspool: Avoid overflow because the size is insufficient.

[Haoyang Chen]

From: Haoyang Chen <[e-mail]>

---
 dlls/winspool.drv/info.c       |  2 +-
 dlls/winspool.drv/tests/info.c | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/dlls/winspool.drv/info.c b/dlls/winspool.drv/info.c
index 6170dc7f90e..868e3f445d5 100644
--- a/dlls/winspool.drv/info.c
+++ b/dlls/winspool.drv/info.c
@@ -4285,7 +4285,7 @@ static BOOL WINSPOOL_GetDriverInfoFromReg(
     WCHAR  driverdir[MAX_PATH];
     DWORD  dirlen;
     LPBYTE strPtr = pDriverStrings;
-    LPDRIVER_INFO_8W di = (LPDRIVER_INFO_8W) ptr;
+    LPDRIVER_INFO_8W di = (cbBuf >= di_sizeof[Level]) ? (LPDRIVER_INFO_8W) ptr : NULL;
 
     TRACE("(%p, %s, %p, %ld, %p, %p, %ld)\n", hkeyDrivers,
           debugstr_w(DriverName), env,
diff --git a/dlls/winspool.drv/tests/info.c b/dlls/winspool.drv/tests/info.c
index 52597e54020..a81ea929520 100644
--- a/dlls/winspool.drv/tests/info.c
+++ b/dlls/winspool.drv/tests/info.c
@@ -2594,6 +2594,16 @@ static void test_GetPrinterDriver(void)
 
         buf = HeapAlloc(GetProcessHeap(), 0, needed);
 
+        SetLastError(0xdeadbeef);
+        filled = -1;
+        if (!ret && pGetPrinterDriverW)
+        {
+            buf[3] = 0xab;
+            ret = pGetPrinterDriverW(hprn, NULL, level, buf, 2 , &filled);
+            ok(ret == FALSE && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "level %d: GetPrinterDriver error %ld\n", level, GetLastError());
+            ok(buf[3] == 0xab, "level %d: buffer overflow detected, buf[3] was %x, expected 0xab\n", level, buf[3]);
+        }
+
         SetLastError(0xdeadbeef);
         filled = -1;
         ret = GetPrinterDriverA(hprn, NULL, level, buf, needed, &filled);
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/11325

[Huw Davies (＠huw)]

Huw Davies (@huw) commented about dlls/winspool.drv/info.c:
> WCHAR  driverdir[MAX_PATH];
>      DWORD  dirlen;
>      LPBYTE strPtr = pDriverStrings;
> -    LPDRIVER_INFO_8W di = (LPDRIVER_INFO_8W) ptr;
> +    LPDRIVER_INFO_8W di = (cbBuf >= di_sizeof[Level]) ? (LPDRIVER_INFO_8W) ptr : NULL;

This doesn't look right; `cbBuf` is supposed to be the size of the string buffer, not the entire memory block.  The caller should have already subtracted the size of the appropriate structure.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11325#note_148910

[Haoyang Chen (＠chenhaoyang)]

On Mon Aug 17 02:47:41 2026 +0000, Huw Davies wrote:
> This doesn't look right; `cbBuf` is supposed to be the size of the
> string buffer, not the entire memory block.  The caller should have
> already subtracted the size of the appropriate structure.
> True, this logic is a bit too rough and kind of misses the point.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11325#note_149023

[Haoyang Chen (＠chenhaoyang)]

On Mon Aug 17 02:53:55 2026 +0000, Haoyang Chen wrote:
> True, this logic is a bit too rough and kind of misses the point.
> I'll push a v2 for this.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11325#note_149025