Re: user32: RegisterClassEx should check for invalid cbSize field.

[Dmitry Timoshkov]

Dylan Smith  wrote:
> - wcexA.cbSize        = 0;
> - wcexA.style         = cls.style;
> - wcexA.lpfnWndProc   = cls.lpfnWndProc;
> - wcexA.cbClsExtra    = cls.cbClsExtra;
> - wcexA.cbWndExtra    = cls.cbWndExtra;
> - wcexA.hInstance     = cls.hInstance;
> - wcexA.hIcon         = cls.hIcon;
> - wcexA.hCursor       = cls.hCursor;
> - wcexA.hbrBackground = cls.hbrBackground;
> - wcexA.lpszMenuName  = cls.lpszMenuName;
> - wcexA.lpszClassName = cls.lpszClassName;
> - wcexA.hIconSm       = 0;
> - ok( ((RegisterClassExA( &wcexA ) == 0) && (GetLastError() == ERROR_INVALID_PARAMETER)),
> -
>      "Failed with invalid number of cbSize bytes\n");

Testing other values besides 0 would be helpful, in particular values like
sizeof(class) - 1 and sizeof(class) + 1. Did you inspect all the places
in Wine which call RegisterClassEx()? Also, GetClassInfoEx() in Wine is an
obvious offender, and this needs a test (and a fix) too.

user32: RegisterClassEx should check for invalid cbSize field.

[Dylan Smith]

On Sat, Jul 17, 2010 at 11:32 PM, Dmitry Timoshkov
wrote:
> Testing other values besides 0 would be helpful, in particular values like
> sizeof(class) - 1 and sizeof(class) + 1. Did you inspect all the places
> in Wine which call RegisterClassEx()? Also, GetClassInfoEx() in Wine is an
> obvious offender, and this needs a test (and a fix) too.
>
> I checked all calls to RegisterClassEx and submitted patches that got

accepted before the end of the code freeze.

I just checked sizeof(class) - 1 and sizeof(class) + 1 on Windows XP and
they also fail.
Surprisingly I found that GetClassInfoEx didn't touch cbSize (e.g. 0 stays
0, 0xdeadbeef stays 0xdeadbeef).
I also checked the unicode version of GetClassInfoEx and RegisterClassEx,
and both have the same behaviour.

Thanks for the advice. I'll add the tests for GetClassInfoEx.