--
v4: mshtml: Implement contentType for XDomainRequest.
mshtml: Implement timeout for XDomainRequest.
mshtml: Implement XDomainRequest.open().
mshtml: Add XDomainRequest factory implementation.
mshtml: Factor out XMLHttpRequest's send.
mshtml: Factor out XMLHttpRequest's open.
mshtml: Factor out XMLHttpRequest's abort.
mshtml: Factor out XMLHttpRequest's get_responseText.
mshtml: Separate the ifaces and the other XHR fields.
mshtml: Factor out XMLHttpRequest constructor init.
mshtml: Factor out XMLHttpRequest creation.
https://gitlab.winehq.org/wine/wine/-/merge_requests/8960
--
v3: win32u: Track mouse events based on last mouse message data.
win32u: Move mouse tracking info into per-thread data.
win32u: Use internal message to handle NtUserTrackMouseEvent() for other thread window.
user32/tests: Add test for (no) messages during TrackMouseEvent() call.
https://gitlab.winehq.org/wine/wine/-/merge_requests/9069
Although dst is a SOCKETADDR_INET *, the object it points to might be smaller than a full
SOCKETADDR_INET. One such example is GetBestInterface -> GetBestInterfaceEx -> GetBestRoute2, where
a socketaddr_in * (16 bytes) is casted to SOCKETADDR_INET * (28 bytes).
This means reading an full SOCKETADDR_INET out of dst could read out-of-bound.
Found by ASan.
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/9085
In wined3d_swapchain_cleanup, before decrementing the reference counts of each of the back/front
buffers, we first set their swapchain to NULL, presumably to stop the current under-destruction
swapchain from being used through them. But there is an oversight.
When we call wined3d_texture_decref on the front_buffer, the back_buffers still have their
swapchains pointing to the swapchain being destroyed. In texture_resource_unload, we call
context_acquire(device, NULL, 0), note the NULL texture parameter here. When the texture parameter
is NULL, wined3d_context_gl_acquire (in turn called by context_acquire) will default to using the
first back buffer from the implicit swapchain of "device", which, as previously stated, has not had
their swapchain set to NULL yet. From here, we reach wined3d_context_gl_activate with a texture
whose swapchain is currently being destroyed. This swapchain is then assigned to "context_gl" here
before being freed, leaving a dangling pointer.
When this context_gl is acquired again later, we will try to access
context_gl->c.swapchain->win_handle, thus complete the use-after-free cycle.
This commit makes sure the swapchain pointer of ALL front and back buffers are set to NULL before
decrementing their reference counts.
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=58325
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/8406