Re: Fix heap corruption in quartz server registration

[Christian Costa]

Hi Mike,

Mike Hearn wrote:
> On Thu, 2005-01-20 at 20:32 +0100, Paul Vriens wrote:
> > Sorry, didn't help.
> >
> > I'm going to try Rob's suggestions now.
>
> This patch fixes it for me.

Thanks! :-)
> Mike Hearn 
> Fix heap corruption in quartz server registration, add
> some whitespace, break out of loop if out of memory
>
> --- dlls/quartz/regsvr.c  (revision 109)
> +++ dlls/quartz/regsvr.c  (local)
> @@ -577,7 +577,6 @@ static HRESULT register_filters(struct r
>     IFilterMapper2* pFM2 = NULL;
> CoInitialize(NULL);
> -
>
> hr = CoCreateInstance(&CLSID_FilterMapper2, NULL, CLSCTX_INPROC_SERVER, &IID_IFilterMapper2, (LPVOID*)&pFM2);
>
> if (SUCCEEDED(hr)) {
>
> @@ -585,6 +584,7 @@ static HRESULT register_filters(struct r
>        REGFILTER2 rf2;
>        REGFILTERPINS2* prfp2;
>        int i;
> -
>  for (i = 0; list->pins[i].flags != 0xFFFFFFFF; i++) ;
>  rf2.dwVersion = 2;
>  rf2.dwMerit = list->merit;
>
> @@ -598,6 +598,7 @@ static HRESULT register_filters(struct r
>    	REGPINTYPES* lpMediatype;
>    	CLSID* lpClsid;
>    	int j, nbmt;
> -
>            
> for (nbmt = 0; list->pins[i].mediatypes[nbmt].majortype; nbmt++) ;
>   /* Allocate a single buffer for regpintypes struct and clsids */
>   lpMediatype = (REGPINTYPES*) CoTaskMemAlloc(nbmt*(sizeof(REGPINTYPES) + 2*sizeof(CLSID)));
>
> @@ -627,10 +628,17 @@ static HRESULT register_filters(struct r
>    	prfp2[i].clsPinCategory = NULL;
>        }
> -
>    if (FAILED(hr)) {
> -
> ERR("failed to register with hresult 0x%lx\n", hr);
> -
> break;
> -
>    }
> -

You should free memory pointed by prfp2 in that case.
>    hr = IFilterMapper2_RegisterFilter(pFM2, list->clsid, list->name, NULL, list->category, NULL, &rf2);
>
> -
>    while (i--)
> -
>    while (i) {
> CoTaskMemFree((REGPINTYPES*)prfp2[i-1].lpMediaType);
> -
> i--;
> -
>    }

Good catch!
>    CoTaskMemFree(prfp2);
>
> }
>     }

Bye,
Christian