Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50506 Signed-off-by: Rémi Bernon rbernon@codeweavers.com ---
v5: Add padding field to align hardware_msg_data on 8 bytes.
dlls/user32/rawinput.c | 2 +- server/protocol.def | 2 ++ server/queue.c | 15 ++++++++++----- 3 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/dlls/user32/rawinput.c b/dlls/user32/rawinput.c index e4e7bad508f..115513ea144 100644 --- a/dlls/user32/rawinput.c +++ b/dlls/user32/rawinput.c @@ -624,7 +624,7 @@ UINT WINAPI DECLSPEC_HOTPATCH GetRawInputBuffer(RAWINPUT *data, UINT *data_size, data->header.dwSize - sizeof(RAWINPUTHEADER)); data->header.dwSize += overhead; data = NEXTRAWINPUTBLOCK(data); - msg_data++; + msg_data = (struct hardware_msg_data *)((char *)msg_data + msg_data->size); }
if (count == 0 && next_size == 0) *data_size = 0; diff --git a/server/protocol.def b/server/protocol.def index 4239be834d1..0c98ac31328 100644 --- a/server/protocol.def +++ b/server/protocol.def @@ -308,6 +308,8 @@ union rawinput struct hardware_msg_data { lparam_t info; /* extra info */ + data_size_t size; /* size of hardware message data */ + int __pad; unsigned int hw_id; /* unique id */ unsigned int flags; /* hook flags */ struct hw_msg_source source; /* message source */ diff --git a/server/queue.c b/server/queue.c index 5d65e030112..07d4c7e0885 100644 --- a/server/queue.c +++ b/server/queue.c @@ -367,6 +367,7 @@ static struct message *alloc_hardware_message( lparam_t info, struct hw_msg_sour
memset( msg_data, 0, sizeof(*msg_data) ); msg_data->info = info; + msg_data->size = msg->data_size; msg_data->source = source; return msg; } @@ -1794,6 +1795,7 @@ static int queue_mouse_message( struct desktop *desktop, user_handle_t win, cons
msg_data = &raw_msg.data; msg_data->info = input->mouse.info; + msg_data->size = sizeof(*msg_data); msg_data->flags = flags; msg_data->rawinput.type = RIM_TYPEMOUSE; msg_data->rawinput.mouse.x = x - desktop->cursor.x; @@ -1929,6 +1931,7 @@ static int queue_keyboard_message( struct desktop *desktop, user_handle_t win, c
msg_data = &raw_msg.data; msg_data->info = input->kbd.info; + msg_data->size = sizeof(*msg_data); msg_data->flags = input->kbd.flags; msg_data->rawinput.type = RIM_TYPEKEYBOARD; msg_data->rawinput.kbd.message = message_code; @@ -1996,6 +1999,7 @@ static void queue_custom_hardware_message( struct desktop *desktop, user_handle_
msg_data = &raw_msg.data; msg_data->info = 0; + msg_data->size = sizeof(*msg_data); msg_data->flags = 0; msg_data->rawinput = input->hw.rawinput;
@@ -3295,16 +3299,17 @@ DECL_HANDLER(get_rawinput_buffer) { struct message *msg = LIST_ENTRY( ptr, struct message, entry ); struct hardware_msg_data *data = msg->data; + data_size_t extra_size = data->size - sizeof(*data);
ptr = list_next( &input->msg_list, ptr ); if (msg->msg != WM_INPUT) continue;
- next_size = req->rawinput_size; + next_size = req->rawinput_size + extra_size; if (size + next_size > req->buffer_size) break; - if (cur + sizeof(*data) > buf + get_reply_max_size()) break; - if (cur + sizeof(*data) > buf + buf_size) + if (cur + data->size > buf + get_reply_max_size()) break; + if (cur + data->size > buf + buf_size) { - buf_size += buf_size / 2; + buf_size += buf_size / 2 + extra_size; if (!(tmp = realloc( buf, buf_size ))) { set_error( STATUS_NO_MEMORY ); @@ -3314,7 +3319,7 @@ DECL_HANDLER(get_rawinput_buffer) buf = tmp; }
- memcpy(cur, data, sizeof(*data)); + memcpy( cur, data, data->size ); list_remove( &msg->entry ); free_message( msg );