Re: [PATCH 2/2] wpcap: Fix crash on pcap_loop

[André Hentschel]

Hi,

Could you please explain what is happing that causes the crash?
Also you should move "res" into the right scope, then you also don't need to initialize it.

Am 07.01.2016 um 09:49 schrieb Jianqiu Zhang:
> From 064be8949c53e43ba56a586d30d2186e5da8cb06 Mon Sep 17 00:00:00 2001
> From: Jianqiu Zhang 
> Date: Tue, 5 Jan 2016 09:12:42 +0800
> Subject: [PATCH 2/2] wpcap: Fix crash on pcap_loop
> Signed-off-by: Jianqiu Zhang
>
> dlls/wpcap/wpcap.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/dlls/wpcap/wpcap.c b/dlls/wpcap/wpcap.c
> index da911c7..0c725a4 100644
> --- a/dlls/wpcap/wpcap.c
> +++ b/dlls/wpcap/wpcap.c
> @@ -95,7 +95,6 @@ static void pcap_handler_callback(u_char *user_data, const struct pcap_pkthdr *h
>     TRACE("(%p %p %p)\n", user_data, h, p);
>     pcb = (PCAP_HANDLER_CALLBACK *)user_data;
>     pcb->pfn_cb(pcb->user_data, h, p);
> - HeapFree(GetProcessHeap(), 0, pcb);
> TRACE("Callback COMPLETED\n");
>
> }
>
> @@ -103,6 +102,7 @@ int CDECL wine_pcap_dispatch(pcap_t *p, int cnt,
>                              void (CALLBACK *callback)(u_char *, const struct pcap_pkthdr *, const u_char *),
>                              unsigned char *user)
> {
> -
>
> int res = 0;
> TRACE("(%p %i %p %p)\n", p, cnt, callback, user);
>
> if (callback)
>
> @@ -111,7 +111,9 @@ int CDECL wine_pcap_dispatch(pcap_t *p, int cnt,
>         pcb = HeapAlloc(GetProcessHeap(), 0, sizeof(PCAP_HANDLER_CALLBACK));
>         pcb->pfn_cb = callback;
>         pcb->user_data = user;
> -
>    return pcap_dispatch(p, cnt, pcap_handler_callback, (unsigned char*)pcb);
> -
>    res = pcap_dispatch(p, cnt, pcap_handler_callback, (unsigned char *)pcb);
> -
>    HeapFree(GetProcessHeap(), 0, pcb);
> -
>    return res;
>
> }
>
> return pcap_dispatch(p, cnt, NULL, user);
>
> @@ -196,6 +198,7 @@ int CDECL wine_pcap_loop(pcap_t *p, int cnt,
>                          void (CALLBACK *callback)(u_char *, const struct pcap_pkthdr *, const u_char *),
>                          unsigned char *user)
> {
> -
>
> int res = 0;
> TRACE("(%p %i %p %p)\n", p, cnt, callback, user);
>
> if (callback)
>
> @@ -204,7 +207,9 @@ int CDECL wine_pcap_loop(pcap_t *p, int cnt,
>         pcb = HeapAlloc(GetProcessHeap(), 0, sizeof(PCAP_HANDLER_CALLBACK));
>         pcb->pfn_cb = callback;
>         pcb->user_data = user;
> -
>    return pcap_loop(p, cnt, pcap_handler_callback, (unsigned char*)pcb);
> -
>    res =  pcap_loop(p, cnt, pcap_handler_callback, (unsigned char *)pcb);
> -
>    HeapFree(GetProcessHeap(), 0, pcb);
> -
>    return res;
>
> }
>
> return pcap_loop(p, cnt, NULL, user);
>
> -- 
> 2.6.4

[PATCH 2/2] wpcap: Fix crash on pcap_loop

[Jianqiu Zhang]

Hi André
> Could you please explain what is happing that causes the crash?

I think the memory that allocated by HeapAlloc for pcb double-frees so it crashes

And The demo program works well on Win32 Platform

And I will provide the demo program mentioned in last reply in the attachment

Below is the information about attachments
----
DumpFile_Test.exe: PE32 executable (console) Intel 80386, for MS Windows
Md5sum : b4394b19665a78c16abc160eaecd7032  DumpFile_Test.exe

DumpFileTestmain.c

[PATCH 2/2] wpcap: Fix crash on pcap_loop

[André Hentschel]

Hi,

Am 26.01.2016 um 04:05 schrieb Jianqiu Zhang:
> Hi André
> > Could you please explain what is happing that causes the crash?

OK, so just move "res" and send the new patch please.