Although dst is a SOCKETADDR_INET *, the object it points to might be smaller than a full
SOCKETADDR_INET. One such example is GetBestInterface -> GetBestInterfaceEx -> GetBestRoute2, where
a socketaddr_in * (16 bytes) is casted to SOCKETADDR_INET * (28 bytes).
This means reading an full SOCKETADDR_INET out of dst could read out-of-bound.
Found by ASan.
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/9085
In wined3d_swapchain_cleanup, before decrementing the reference counts of each of the back/front
buffers, we first set their swapchain to NULL, presumably to stop the current under-destruction
swapchain from being used through them. But there is an oversight.
When we call wined3d_texture_decref on the front_buffer, the back_buffers still have their
swapchains pointing to the swapchain being destroyed. In texture_resource_unload, we call
context_acquire(device, NULL, 0), note the NULL texture parameter here. When the texture parameter
is NULL, wined3d_context_gl_acquire (in turn called by context_acquire) will default to using the
first back buffer from the implicit swapchain of "device", which, as previously stated, has not had
their swapchain set to NULL yet. From here, we reach wined3d_context_gl_activate with a texture
whose swapchain is currently being destroyed. This swapchain is then assigned to "context_gl" here
before being freed, leaving a dangling pointer.
When this context_gl is acquired again later, we will try to access
context_gl->c.swapchain->win_handle, thus complete the use-after-free cycle.
This commit makes sure the swapchain pointer of ALL front and back buffers are set to NULL before
decrementing their reference counts.
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=58325
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/8406
Mostly for vendoring of future fluidsynth versions.
--
v2: libs/fluidsynth: Use InterlockedExchangeAdd() in g_atomic_int_add().
libs/fluidsynth: Return thread return value from g_thread_join().
libs/fluidsynth: Fix definition of g_atomic_int_dec_and_test().
libs/fluidsynth: Fix argument flag handling in g_file_test().
libs/fluidsynth: Round up sleep duration in g_usleep().
libs/fluidsynth: Use full memory barrier in g_atomic_int_get().
libs/fluidsynth: Fix double close of thread handle in g_thread_unref().
libs/fluidsynth: Fix g_mutex_init() and g_cond_init().
https://gitlab.winehq.org/wine/wine/-/merge_requests/9023
--
v4: win32u: Read extra class info from the shared memory object.
server: Move extra class info to the shared memory object.
server: Allocate shared memory objects with dynamic size.
win32u: Read class info from the shared memory object.
server: Move class info to the shared memory object.
https://gitlab.winehq.org/wine/wine/-/merge_requests/8976