Signed-off-by: Hans Leidekker hans@codeweavers.com --- dlls/webservices/reader.c | 19 +++++------ dlls/webservices/tests/reader.c | 60 +++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 10 deletions(-)
diff --git a/dlls/webservices/reader.c b/dlls/webservices/reader.c index ffa789fb6e6..c30abf5acd8 100644 --- a/dlls/webservices/reader.c +++ b/dlls/webservices/reader.c @@ -4495,8 +4495,7 @@ static HRESULT text_to_int8( const WS_XML_TEXT *text, INT64 *val ) case WS_XML_TEXT_TYPE_INT32: { const WS_XML_INT32_TEXT *text_int32 = (const WS_XML_INT32_TEXT *)text; - assert( text_int32->value >= MIN_INT8 ); - assert( text_int32->value <= MAX_INT8 ); + if (text_int32->value < MIN_INT8 || text_int32->value > MAX_INT8) return WS_E_NUMERIC_OVERFLOW; *val = text_int32->value; hr = S_OK; break; @@ -4577,8 +4576,7 @@ static HRESULT text_to_int16( const WS_XML_TEXT *text, INT64 *val ) case WS_XML_TEXT_TYPE_INT32: { const WS_XML_INT32_TEXT *text_int32 = (const WS_XML_INT32_TEXT *)text; - assert( text_int32->value >= MIN_INT16 ); - assert( text_int32->value <= MAX_INT16 ); + if (text_int32->value < MIN_INT16 || text_int32->value > MAX_INT16) return WS_E_NUMERIC_OVERFLOW; *val = text_int32->value; hr = S_OK; break; @@ -4819,7 +4817,7 @@ static HRESULT text_to_uint8( const WS_XML_TEXT *text, UINT64 *val ) case WS_XML_TEXT_TYPE_UINT64: { const WS_XML_UINT64_TEXT *text_uint64 = (const WS_XML_UINT64_TEXT *)text; - assert( text_uint64->value <= MAX_UINT8 ); + if (text_uint64->value > MAX_UINT8) return WS_E_NUMERIC_OVERFLOW; *val = text_uint64->value; hr = S_OK; break; @@ -4900,8 +4898,7 @@ static HRESULT text_to_uint16( const WS_XML_TEXT *text, UINT64 *val ) case WS_XML_TEXT_TYPE_INT32: { const WS_XML_INT32_TEXT *text_int32 = (const WS_XML_INT32_TEXT *)text; - assert( text_int32->value >= 0 ); - assert( text_int32->value <= MAX_UINT16 ); + if (text_int32->value < 0 || text_int32->value > MAX_UINT16) return WS_E_NUMERIC_OVERFLOW; *val = text_int32->value; hr = S_OK; break; @@ -4909,7 +4906,7 @@ static HRESULT text_to_uint16( const WS_XML_TEXT *text, UINT64 *val ) case WS_XML_TEXT_TYPE_UINT64: { const WS_XML_UINT64_TEXT *text_uint64 = (const WS_XML_UINT64_TEXT *)text; - assert( text_uint64->value <= MAX_UINT16 ); + if (text_uint64->value > MAX_UINT16) return WS_E_NUMERIC_OVERFLOW; *val = text_uint64->value; hr = S_OK; break; @@ -4990,7 +4987,7 @@ static HRESULT text_to_uint32( const WS_XML_TEXT *text, UINT64 *val ) case WS_XML_TEXT_TYPE_INT32: { const WS_XML_INT32_TEXT *text_int32 = (const WS_XML_INT32_TEXT *)text; - assert( text_int32->value >= 0 ); + if (text_int32->value < 0) return WS_E_NUMERIC_OVERFLOW; *val = text_int32->value; hr = S_OK; break; @@ -4998,7 +4995,7 @@ static HRESULT text_to_uint32( const WS_XML_TEXT *text, UINT64 *val ) case WS_XML_TEXT_TYPE_UINT64: { const WS_XML_UINT64_TEXT *text_uint64 = (const WS_XML_UINT64_TEXT *)text; - assert( text_uint64->value <= MAX_UINT32 ); + if (text_uint64->value > MAX_UINT32) return WS_E_NUMERIC_OVERFLOW; *val = text_uint64->value; hr = S_OK; break; @@ -5079,6 +5076,7 @@ static HRESULT text_to_uint64( const WS_XML_TEXT *text, UINT64 *val ) case WS_XML_TEXT_TYPE_INT32: { const WS_XML_INT32_TEXT *text_int32 = (const WS_XML_INT32_TEXT *)text; + if (text_int32->value < 0) return WS_E_NUMERIC_OVERFLOW; *val = text_int32->value; hr = S_OK; break; @@ -5086,6 +5084,7 @@ static HRESULT text_to_uint64( const WS_XML_TEXT *text, UINT64 *val ) case WS_XML_TEXT_TYPE_INT64: { const WS_XML_INT64_TEXT *text_int64 = (const WS_XML_INT64_TEXT *)text; + if (text_int64->value < 0) return WS_E_NUMERIC_OVERFLOW; *val = text_int64->value; hr = S_OK; break; diff --git a/dlls/webservices/tests/reader.c b/dlls/webservices/tests/reader.c index 7d56ebccd53..7ecb77fe6cd 100644 --- a/dlls/webservices/tests/reader.c +++ b/dlls/webservices/tests/reader.c @@ -4937,6 +4937,8 @@ static void test_binary_encoding(void) {0x40,0x01,'t',0x08,0x02,'n','s',0x01}; static const char test31[] = {0x40,0x01,'t',0x09,0x01,'p',0x02,'n','s',0x01}; + static const char test32[] = + {0x40,0x01,'t',0xb3,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff}; static const char test100[] = {0x40,0x01,'t',0x04,0x01,'t',0x98,0x00,0x01}; static const char test101[] = @@ -4973,6 +4975,14 @@ static void test_binary_encoding(void) { WS_BYTES data; } *typetest; + struct typetest2 + { + UINT32 val; + } *typetest2; + struct typetest3 + { + UINT64 val; + } *typetest3;
hr = WsGetDictionary( WS_ENCODING_XML_BINARY_1, &dict, NULL ); ok( hr == S_OK, "got %08x\n", hr ); @@ -5629,6 +5639,56 @@ static void test_binary_encoding(void) ok( typetest->data.length == 2, "got %u\n", typetest->data.length ); ok( !memcmp( typetest->data.bytes, "ab", 2 ), "wrong data\n" );
+ /* record value too large for description type */ + hr = set_input_bin( reader, test32, sizeof(test32), NULL ); + ok( hr == S_OK, "got %08x\n", hr ); + + hr = WsCreateHeap( 1 << 8, 0, NULL, 0, &heap, NULL ); + ok( hr == S_OK, "got %08x\n", hr ); + + memset( &f, 0, sizeof(f) ); + f.mapping = WS_ELEMENT_FIELD_MAPPING; + f.localName = &localname; + f.ns = &ns; + f.type = WS_UINT32_TYPE; + f.offset = FIELD_OFFSET(struct typetest2, val); + fields[0] = &f; + + memset( &s, 0, sizeof(s) ); + s.size = sizeof(struct typetest2); + s.alignment = TYPE_ALIGNMENT(struct typetest2); + s.fields = fields; + s.fieldCount = 1; + + hr = WsReadType( reader, WS_ELEMENT_CONTENT_TYPE_MAPPING, WS_STRUCT_TYPE, &s, + WS_READ_REQUIRED_POINTER, heap, &typetest2, sizeof(typetest2), NULL ); + ok( hr == WS_E_NUMERIC_OVERFLOW, "got %08x\n", hr ); + + /* record value too small for description type */ + hr = set_input_bin( reader, test16, sizeof(test16), NULL ); + ok( hr == S_OK, "got %08x\n", hr ); + + hr = WsCreateHeap( 1 << 8, 0, NULL, 0, &heap, NULL ); + ok( hr == S_OK, "got %08x\n", hr ); + + memset( &f, 0, sizeof(f) ); + f.mapping = WS_ELEMENT_FIELD_MAPPING; + f.localName = &localname; + f.ns = &ns; + f.type = WS_UINT64_TYPE; + f.offset = FIELD_OFFSET(struct typetest3, val); + fields[0] = &f; + + memset( &s, 0, sizeof(s) ); + s.size = sizeof(struct typetest3); + s.alignment = TYPE_ALIGNMENT(struct typetest3); + s.fields = fields; + s.fieldCount = 1; + + hr = WsReadType( reader, WS_ELEMENT_CONTENT_TYPE_MAPPING, WS_STRUCT_TYPE, &s, + WS_READ_REQUIRED_POINTER, heap, &typetest3, sizeof(typetest3), NULL ); + ok( hr == WS_E_NUMERIC_OVERFLOW, "got %08x\n", hr ); + WsFreeHeap( heap ); WsFreeReader( reader ); }