-- v2: dplayx: Check ENUMSESSIONSREPLY size before access. dplayx: Check the message size before access. dplayx/tests: Correctly compute session enumeration reply size. dplayx: Send password in session enumeration request. dplayx: Reduce nesting of the async enumeration code.
From: Anton Baskanov baskanov@gmail.com
--- dlls/dplayx/dplay.c | 116 +++++++++++++++++++------------------------- 1 file changed, 50 insertions(+), 66 deletions(-)
diff --git a/dlls/dplayx/dplay.c b/dlls/dplayx/dplay.c index 9f149879c2b..c61e450d987 100644 --- a/dlls/dplayx/dplay.c +++ b/dlls/dplayx/dplay.c @@ -21,6 +21,7 @@
#include <stdarg.h> #include <string.h> +#include <limits.h>
#include "windef.h" #include "winerror.h" @@ -260,6 +261,48 @@ static inline DPID DP_NextObjectId(void) return (DPID)InterlockedIncrement( &kludgePlayerGroupId ); }
+static DWORD DP_CopyString( char **dst, const void *src, BOOL dstAnsi, BOOL srcAnsi, void *buffer, DWORD offset ) +{ + void *dstPtr = NULL; + DWORD dstSize = 0; + DWORD size; + + if ( !src ) + { + if ( buffer ) + *dst = NULL; + + return 0; + } + + if ( buffer ) + { + dstPtr = (char *) buffer + offset; + dstSize = INT_MAX; + *dst = dstPtr; + } + + if ( dstAnsi == srcAnsi ) + { + if ( srcAnsi ) + size = strlen( src ) + 1; + else + size = (wcslen( src ) + 1) * sizeof( WCHAR ); + + if ( dstPtr ) + memcpy( dstPtr, src, size ); + } + else + { + if ( srcAnsi ) + size = MultiByteToWideChar( CP_ACP, 0, src, -1, dstPtr, dstSize ) * sizeof( WCHAR ); + else + size = WideCharToMultiByte( CP_ACP, 0, src, -1, dstPtr, dstSize, NULL, NULL ); + } + + return size; +} + /* *lplpReply will be non NULL iff there is something to reply */ HRESULT DP_HandleMessage( IDirectPlayImpl *This, const void *lpcMessageBody, DWORD dwMessageBodySize, const void *lpcMessageHeader, WORD wCommandId, WORD wVersion, @@ -3863,33 +3906,8 @@ static DWORD DP_CalcSessionDescSize( LPCDPSESSIONDESC2 lpSessDesc, BOOL bAnsi ) }
dwSize += sizeof( *lpSessDesc ); - - if( bAnsi ) - { - if( lpSessDesc->lpszSessionNameA ) - { - dwSize += lstrlenA( lpSessDesc->lpszSessionNameA ) + 1; - } - - if( lpSessDesc->lpszPasswordA ) - { - dwSize += lstrlenA( lpSessDesc->lpszPasswordA ) + 1; - } - } - else /* UNICODE */ - { - if( lpSessDesc->lpszSessionName ) - { - dwSize += sizeof( WCHAR ) * - ( lstrlenW( lpSessDesc->lpszSessionName ) + 1 ); - } - - if( lpSessDesc->lpszPassword ) - { - dwSize += sizeof( WCHAR ) * - ( lstrlenW( lpSessDesc->lpszPassword ) + 1 ); - } - } + dwSize += DP_CopyString( NULL, lpSessDesc->lpszSessionNameA, bAnsi, bAnsi, NULL, 0 ); + dwSize += DP_CopyString( NULL, lpSessDesc->lpszPasswordA, bAnsi, bAnsi, NULL, 0 );
return dwSize; } @@ -3898,7 +3916,7 @@ static DWORD DP_CalcSessionDescSize( LPCDPSESSIONDESC2 lpSessDesc, BOOL bAnsi ) static void DP_CopySessionDesc( LPDPSESSIONDESC2 lpSessionDest, LPCDPSESSIONDESC2 lpSessionSrc, BOOL bAnsi ) { - BYTE* lpStartOfFreeSpace; + DWORD offset = sizeof( DPSESSIONDESC2 );
if( lpSessionDest == NULL ) { @@ -3908,44 +3926,10 @@ static void DP_CopySessionDesc( LPDPSESSIONDESC2 lpSessionDest,
CopyMemory( lpSessionDest, lpSessionSrc, sizeof( *lpSessionSrc ) );
- lpStartOfFreeSpace = ((BYTE*)lpSessionDest) + sizeof( *lpSessionSrc ); - - if( bAnsi ) - { - if( lpSessionSrc->lpszSessionNameA ) - { - lstrcpyA( (LPSTR)lpStartOfFreeSpace, - lpSessionDest->lpszSessionNameA ); - lpSessionDest->lpszSessionNameA = (LPSTR)lpStartOfFreeSpace; - lpStartOfFreeSpace += - lstrlenA( lpSessionDest->lpszSessionNameA ) + 1; - } - - if( lpSessionSrc->lpszPasswordA ) - { - lstrcpyA( (LPSTR)lpStartOfFreeSpace, - lpSessionDest->lpszPasswordA ); - lpSessionDest->lpszPasswordA = (LPSTR)lpStartOfFreeSpace; - } - } - else /* UNICODE */ - { - if( lpSessionSrc->lpszSessionName ) - { - lstrcpyW( (LPWSTR)lpStartOfFreeSpace, - lpSessionDest->lpszSessionName ); - lpSessionDest->lpszSessionName = (LPWSTR)lpStartOfFreeSpace; - lpStartOfFreeSpace += sizeof(WCHAR) * - ( lstrlenW( lpSessionDest->lpszSessionName ) + 1 ); - } - - if( lpSessionSrc->lpszPassword ) - { - lstrcpyW( (LPWSTR)lpStartOfFreeSpace, - lpSessionDest->lpszPassword ); - lpSessionDest->lpszPassword = (LPWSTR)lpStartOfFreeSpace; - } - } + offset += DP_CopyString( &lpSessionDest->lpszSessionNameA, lpSessionSrc->lpszSessionNameA, bAnsi, + bAnsi, lpSessionDest, offset ); + offset += DP_CopyString( &lpSessionDest->lpszPasswordA, lpSessionSrc->lpszPasswordA, bAnsi, + bAnsi, lpSessionDest, offset ); }
static HRESULT WINAPI IDirectPlay3AImpl_AddGroupToGroup( IDirectPlay3A *iface, DPID parent,
From: Anton Baskanov baskanov@gmail.com
--- dlls/dplayx/dplay.c | 83 ++++++++++++++++++++++++--------------------- 1 file changed, 44 insertions(+), 39 deletions(-)
diff --git a/dlls/dplayx/dplay.c b/dlls/dplayx/dplay.c index c61e450d987..1ffc006cd04 100644 --- a/dlls/dplayx/dplay.c +++ b/dlls/dplayx/dplay.c @@ -2446,11 +2446,13 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS DWORD timeout, LPDPENUMSESSIONSCALLBACK2 enumsessioncb, void *context, DWORD flags ) { IDirectPlayImpl *This = impl_from_IDirectPlay4( iface ); + EnumSessionAsyncCallbackData *data; DWORD defaultTimeout; void *connection; DPCAPS caps; DWORD size; - HRESULT hr = DP_OK; + HRESULT hr; + DWORD tid;
TRACE( "(%p)->(%p,0x%08lx,%p,%p,0x%08lx)\n", This, sdesc, timeout, enumsessioncb, context, flags ); @@ -2506,7 +2508,7 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS if ( flags & DPENUMSESSIONS_STOPASYNC ) { DP_KillEnumSessionThread( This ); - return hr; + return DP_OK; }
for ( ;; ) @@ -2540,47 +2542,50 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS break; }
- if ( flags & DPENUMSESSIONS_ASYNC ) - { - if ( This->dp2->dwEnumSessionLock ) - return DPERR_CONNECTING; + if ( !(flags & DPENUMSESSIONS_ASYNC) ) + return DP_OK;
- /* See if we've already created a thread to service this interface */ - if ( This->dp2->hEnumSessionThread == INVALID_HANDLE_VALUE ) - { - DWORD tid; - This->dp2->dwEnumSessionLock++; + /* Async enumeration */
- /* Send the first enum request inline since the user may cancel a dialog - * if one is presented. Also, may also have a connecting return code. - */ - hr = NS_SendSessionRequestBroadcast( &sdesc->guidApplication, flags, - &This->dp2->spData ); - - if ( SUCCEEDED(hr) ) - { - EnumSessionAsyncCallbackData* data = calloc( 1, sizeof( *data ) ); - /* FIXME: need to kill the thread on object deletion */ - data->lpSpData = &This->dp2->spData; - data->requestGuid = sdesc->guidApplication; - data->dwEnumSessionFlags = flags; - data->dwTimeout = timeout ? timeout : defaultTimeout; - - This->dp2->hKillEnumSessionThreadEvent = CreateEventW( NULL, TRUE, FALSE, NULL ); - if ( !DuplicateHandle( GetCurrentProcess(), This->dp2->hKillEnumSessionThreadEvent, - GetCurrentProcess(), &data->hSuicideRequest, 0, FALSE, - DUPLICATE_SAME_ACCESS ) ) - ERR( "Can't duplicate thread killing handle\n" ); - - TRACE( ": creating EnumSessionsRequest thread\n" ); - This->dp2->hEnumSessionThread = CreateThread( NULL, 0, - DP_EnumSessionsSendAsyncRequestThread, data, 0, &tid ); - } - This->dp2->dwEnumSessionLock--; - } + if ( This->dp2->dwEnumSessionLock ) + return DPERR_CONNECTING; + + /* See if we've already created a thread to service this interface */ + if ( This->dp2->hEnumSessionThread != INVALID_HANDLE_VALUE ) + return DP_OK; + + This->dp2->dwEnumSessionLock++; + + /* Send the first enum request inline since the user may cancel a dialog + * if one is presented. Also, may also have a connecting return code. + */ + hr = NS_SendSessionRequestBroadcast( &sdesc->guidApplication, flags, &This->dp2->spData ); + if ( FAILED( hr ) ) + { + This->dp2->dwEnumSessionLock--; + return hr; }
- return hr; + data = calloc( 1, sizeof( *data ) ); + /* FIXME: need to kill the thread on object deletion */ + data->lpSpData = &This->dp2->spData; + data->requestGuid = sdesc->guidApplication; + data->dwEnumSessionFlags = flags; + data->dwTimeout = timeout ? timeout : defaultTimeout; + + This->dp2->hKillEnumSessionThreadEvent = CreateEventW( NULL, TRUE, FALSE, NULL ); + if ( !DuplicateHandle( GetCurrentProcess(), This->dp2->hKillEnumSessionThreadEvent, + GetCurrentProcess(), &data->hSuicideRequest, 0, FALSE, + DUPLICATE_SAME_ACCESS ) ) + ERR( "Can't duplicate thread killing handle\n" ); + + TRACE( ": creating EnumSessionsRequest thread\n" ); + This->dp2->hEnumSessionThread = CreateThread( NULL, 0, DP_EnumSessionsSendAsyncRequestThread, + data, 0, &tid ); + + This->dp2->dwEnumSessionLock--; + + return DP_OK; }
static HRESULT WINAPI IDirectPlay2AImpl_GetCaps( IDirectPlay2A *iface, DPCAPS *caps, DWORD flags )
From: Anton Baskanov baskanov@gmail.com
--- dlls/dplayx/dplay.c | 47 +++++++++++++++++++++++++++++++++-- dlls/dplayx/dplay_global.h | 1 + dlls/dplayx/dplayx_messages.h | 4 +-- dlls/dplayx/name_server.c | 12 ++++++--- dlls/dplayx/name_server.h | 1 + dlls/dplayx/tests/dplayx.c | 13 +++++----- 6 files changed, 62 insertions(+), 16 deletions(-)
diff --git a/dlls/dplayx/dplay.c b/dlls/dplayx/dplay.c index 1ffc006cd04..d74b1a25bfe 100644 --- a/dlls/dplayx/dplay.c +++ b/dlls/dplayx/dplay.c @@ -303,6 +303,25 @@ static DWORD DP_CopyString( char **dst, const void *src, BOOL dstAnsi, BOOL srcA return size; }
+static void *DP_DuplicateString( void *src, BOOL dstAnsi, BOOL srcAnsi ) +{ + DWORD size; + char *dst; + + if ( !src ) + return NULL; + + size = DP_CopyString( NULL, src, dstAnsi, srcAnsi, NULL, 0 ); + + dst = malloc( size ); + if ( !dst ) + return NULL; + + DP_CopyString( &dst, src, dstAnsi, srcAnsi, dst, 0 ); + + return dst; +} + /* *lplpReply will be non NULL iff there is something to reply */ HRESULT DP_HandleMessage( IDirectPlayImpl *This, const void *lpcMessageBody, DWORD dwMessageBodySize, const void *lpcMessageHeader, WORD wCommandId, WORD wVersion, @@ -2357,6 +2376,7 @@ static DWORD CALLBACK DP_EnumSessionsSendAsyncRequestThread( LPVOID lpContext ) /* Now resend the enum request */ hr = NS_SendSessionRequestBroadcast( &data->requestGuid, data->dwEnumSessionFlags, + data->password, data->lpSpData );
if( FAILED(hr) ) @@ -2371,6 +2391,7 @@ static DWORD CALLBACK DP_EnumSessionsSendAsyncRequestThread( LPVOID lpContext )
/* Clean up the thread data */ CloseHandle( hSuicideRequest ); + free( data->password ); free( lpContext );
/* FIXME: Need to have some notification to main app thread that this is @@ -2447,6 +2468,7 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS { IDirectPlayImpl *This = impl_from_IDirectPlay4( iface ); EnumSessionAsyncCallbackData *data; + WCHAR *password = NULL; DWORD defaultTimeout; void *connection; DPCAPS caps; @@ -2511,6 +2533,10 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS return DP_OK; }
+ password = DP_DuplicateString( sdesc->lpszPassword, FALSE, TRUE ); + if ( !password && sdesc->lpszPassword ) + return DPERR_OUTOFMEMORY; + for ( ;; ) { if ( !(flags & DPENUMSESSIONS_ASYNC) ) @@ -2523,10 +2549,13 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS LeaveCriticalSection( &This->lock );
/* Send the broadcast for session enumeration */ - hr = NS_SendSessionRequestBroadcast( &sdesc->guidApplication, flags, + hr = NS_SendSessionRequestBroadcast( &sdesc->guidApplication, flags, password, &This->dp2->spData ); if ( FAILED( hr ) ) + { + free( password ); return hr; + } SleepEx( timeout ? timeout : defaultTimeout, FALSE ); }
@@ -2543,26 +2572,37 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS }
if ( !(flags & DPENUMSESSIONS_ASYNC) ) + { + free( password ); return DP_OK; + }
/* Async enumeration */
if ( This->dp2->dwEnumSessionLock ) + { + free( password ); return DPERR_CONNECTING; + }
/* See if we've already created a thread to service this interface */ if ( This->dp2->hEnumSessionThread != INVALID_HANDLE_VALUE ) + { + free( password ); return DP_OK; + }
This->dp2->dwEnumSessionLock++;
/* Send the first enum request inline since the user may cancel a dialog * if one is presented. Also, may also have a connecting return code. */ - hr = NS_SendSessionRequestBroadcast( &sdesc->guidApplication, flags, &This->dp2->spData ); + hr = NS_SendSessionRequestBroadcast( &sdesc->guidApplication, flags, password, + &This->dp2->spData ); if ( FAILED( hr ) ) { This->dp2->dwEnumSessionLock--; + free( password ); return hr; }
@@ -2572,6 +2612,7 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS data->requestGuid = sdesc->guidApplication; data->dwEnumSessionFlags = flags; data->dwTimeout = timeout ? timeout : defaultTimeout; + data->password = password;
This->dp2->hKillEnumSessionThreadEvent = CreateEventW( NULL, TRUE, FALSE, NULL ); if ( !DuplicateHandle( GetCurrentProcess(), This->dp2->hKillEnumSessionThreadEvent, @@ -2582,6 +2623,8 @@ static HRESULT WINAPI IDirectPlay4Impl_EnumSessions( IDirectPlay4 *iface, DPSESS TRACE( ": creating EnumSessionsRequest thread\n" ); This->dp2->hEnumSessionThread = CreateThread( NULL, 0, DP_EnumSessionsSendAsyncRequestThread, data, 0, &tid ); + if ( !This->dp2->hEnumSessionThread ) + free( password );
This->dp2->dwEnumSessionLock--;
diff --git a/dlls/dplayx/dplay_global.h b/dlls/dplayx/dplay_global.h index 7ee91ba0402..e81c57a4442 100644 --- a/dlls/dplayx/dplay_global.h +++ b/dlls/dplayx/dplay_global.h @@ -37,6 +37,7 @@ typedef struct tagEnumSessionAsyncCallbackData GUID requestGuid; DWORD dwEnumSessionFlags; DWORD dwTimeout; + WCHAR *password; HANDLE hSuicideRequest; } EnumSessionAsyncCallbackData;
diff --git a/dlls/dplayx/dplayx_messages.h b/dlls/dplayx/dplayx_messages.h index 8c09c8d3749..c8758d3ddb1 100644 --- a/dlls/dplayx/dplayx_messages.h +++ b/dlls/dplayx/dplayx_messages.h @@ -142,9 +142,7 @@ typedef struct tagDPMSG_ENUMSESSIONSREQUEST
GUID guidApplication;
- DWORD dwPasswordSize; /* A Guess. This is 0x00000000. */ - /* This might be the name server DPID which - is needed for the reply */ + DWORD passwordOffset;
DWORD dwFlags; /* dwFlags from EnumSessions */
diff --git a/dlls/dplayx/name_server.c b/dlls/dplayx/name_server.c index ddd4ad57e42..4fabf64d32a 100644 --- a/dlls/dplayx/name_server.c +++ b/dlls/dplayx/name_server.c @@ -195,18 +195,20 @@ void NS_SetLocalAddr( LPVOID lpNSInfo, LPCVOID lpHdr, DWORD dwHdrSize ) */ HRESULT NS_SendSessionRequestBroadcast( LPCGUID lpcGuid, DWORD dwFlags, + WCHAR *password, const SPINITDATA *lpSpData )
{ DPSP_ENUMSESSIONSDATA data; LPDPMSG_ENUMSESSIONSREQUEST lpMsg; + DWORD passwordSize = 0;
TRACE( "enumerating for guid %s\n", debugstr_guid( lpcGuid ) );
- /* Get the SP to deal with sending the EnumSessions request */ - FIXME( ": not all data fields are correct\n" ); + if ( password ) + passwordSize = (wcslen( password ) + 1) * sizeof( WCHAR );
- data.dwMessageSize = lpSpData->dwSPHeaderSize + sizeof( *lpMsg ); /*FIXME!*/ + data.dwMessageSize = lpSpData->dwSPHeaderSize + sizeof( *lpMsg ) + passwordSize; data.lpMessage = calloc( 1, data.dwMessageSize ); data.lpISP = lpSpData->lpISP; data.bReturnStatus = (dwFlags & DPENUMSESSIONS_RETURNSTATUS) != 0; @@ -219,11 +221,13 @@ HRESULT NS_SendSessionRequestBroadcast( LPCGUID lpcGuid, lpMsg->envelope.wCommandId = DPMSGCMD_ENUMSESSIONSREQUEST; lpMsg->envelope.wVersion = DPMSGVER_DP6;
- lpMsg->dwPasswordSize = 0; /* FIXME: If enumerating passwords..? */ + lpMsg->passwordOffset = password ? sizeof( DPMSG_ENUMSESSIONSREQUEST ) : 0; lpMsg->dwFlags = dwFlags;
lpMsg->guidApplication = *lpcGuid;
+ memcpy( lpMsg + 1, password, passwordSize ); + return (lpSpData->lpCB->EnumSessions)( &data ); }
diff --git a/dlls/dplayx/name_server.h b/dlls/dplayx/name_server.h index 30c5bc7e9ae..70612ecf00f 100644 --- a/dlls/dplayx/name_server.h +++ b/dlls/dplayx/name_server.h @@ -44,6 +44,7 @@ void NS_ReplyToEnumSessionsRequest( LPCVOID lpcMsg,
HRESULT NS_SendSessionRequestBroadcast( LPCGUID lpcGuid, DWORD dwFlags, + WCHAR *password, const SPINITDATA *lpSpData );
diff --git a/dlls/dplayx/tests/dplayx.c b/dlls/dplayx/tests/dplayx.c index 229183a43f7..9e0e6fdec96 100644 --- a/dlls/dplayx/tests/dplayx.c +++ b/dlls/dplayx/tests/dplayx.c @@ -865,21 +865,20 @@ static unsigned short receiveEnumSessionsRequest_( int line, SOCKET sock, const expectedSize = sizeof( request.spHeader ) + sizeof( request.request ) + expectedPasswordSize;
wsResult = receiveMessage_( line, sock, &request, sizeof( request ) ); - todo_wine_if( expectedPassword ) ok_( __FILE__, line )( wsResult == expectedSize, "recv() returned %d.\n", - wsResult ); + ok_( __FILE__, line )( wsResult == expectedSize, "recv() returned %d.\n", wsResult ); if ( wsResult == SOCKET_ERROR ) return 0;
- port = checkSpHeader_( line, &request.spHeader, expectedSize, expectedPassword != NULL ); + port = checkSpHeader_( line, &request.spHeader, expectedSize, FALSE ); checkMessageHeader_( line, &request.request.header, 2 ); ok_( __FILE__, line )( IsEqualGUID( &request.request.appGuid, expectedAppGuid ), "got app guid %s.\n", wine_dbgstr_guid( &request.request.appGuid ) ); if ( expectedPassword ) { - todo_wine ok_( __FILE__, line )( request.request.passwordOffset == 32, "got password offset %lu.\n", - request.request.passwordOffset ); - todo_wine ok_( __FILE__, line )( !lstrcmpW( request.password, expectedPassword ), "got password %s.\n", - wine_dbgstr_w( request.password ) ); + ok_( __FILE__, line )( request.request.passwordOffset == 32, "got password offset %lu.\n", + request.request.passwordOffset ); + ok_( __FILE__, line )( !lstrcmpW( request.password, expectedPassword ), "got password %s.\n", + wine_dbgstr_w( request.password ) ); } else {
From: Anton Baskanov baskanov@gmail.com
--- dlls/dplayx/tests/dplayx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/dlls/dplayx/tests/dplayx.c b/dlls/dplayx/tests/dplayx.c index 9e0e6fdec96..1b846c7f51a 100644 --- a/dlls/dplayx/tests/dplayx.c +++ b/dlls/dplayx/tests/dplayx.c @@ -921,15 +921,17 @@ static void sendEnumSessionsReply_( int line, SOCKET sock, unsigned short port, .nameOffset = sizeof( reply.reply ), }, }; + DWORD passwordSize; int wsResult; DWORD size;
- size = sizeof( reply ) + (lstrlenW( dpsd->lpszSessionName ) + 1) * sizeof( WCHAR ); + passwordSize = (lstrlenW( dpsd->lpszSessionName ) + 1) * sizeof( WCHAR ); + size = sizeof( reply.spHeader ) + sizeof( reply.reply ) + passwordSize;
reply.spHeader.mixed += size; reply.reply.dpsd.lpszSessionName = NULL; reply.reply.dpsd.lpszPassword = NULL; - lstrcpyW( reply.name, dpsd->lpszSessionName ); + memcpy( reply.name, dpsd->lpszSessionName, passwordSize );
wsResult = send( sock, (char *) &reply, size, 0 ); ok_( __FILE__, line )( wsResult == size, "send() returned %d.\n", wsResult );
From: Anton Baskanov baskanov@gmail.com
--- dlls/dplayx/dplaysp.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/dlls/dplayx/dplaysp.c b/dlls/dplayx/dplaysp.c index fa6ea871495..535e7fa85c2 100644 --- a/dlls/dplayx/dplaysp.c +++ b/dlls/dplayx/dplaysp.c @@ -219,6 +219,9 @@ static HRESULT WINAPI IDirectPlaySPImpl_HandleMessage( IDirectPlaySP *iface, voi FIXME( "(%p)->(%p,0x%08lx,%p): mostly stub\n", This, lpMessageBody, dwMessageBodySize, lpMessageHeader );
+ if ( dwMessageBodySize < sizeof( DPMSG_SENDENVELOPE ) ) + return DPERR_GENERIC; + wCommandId = lpMsg->wCommandId; wVersion = lpMsg->wVersion;
From: Anton Baskanov baskanov@gmail.com
--- dlls/dplayx/dplay.c | 1 + dlls/dplayx/name_server.c | 11 +++++++++++ dlls/dplayx/name_server.h | 1 + 3 files changed, 13 insertions(+)
diff --git a/dlls/dplayx/dplay.c b/dlls/dplayx/dplay.c index d74b1a25bfe..811a22fab77 100644 --- a/dlls/dplayx/dplay.c +++ b/dlls/dplayx/dplay.c @@ -347,6 +347,7 @@ HRESULT DP_HandleMessage( IDirectPlayImpl *This, const void *lpcMessageBody, NS_AddRemoteComputerAsNameServer( lpcMessageHeader, This->dp2->spData.dwSPHeaderSize, lpcMessageBody, + dwMessageBodySize, This->dp2->lpNameServerData );
LeaveCriticalSection( &This->lock ); diff --git a/dlls/dplayx/name_server.c b/dlls/dplayx/name_server.c index 4fabf64d32a..1342cb7b962 100644 --- a/dlls/dplayx/name_server.c +++ b/dlls/dplayx/name_server.c @@ -89,14 +89,25 @@ static DPQ_DECL_COMPARECB( cbUglyPig, GUID ) void NS_AddRemoteComputerAsNameServer( LPCVOID lpcNSAddrHdr, DWORD dwHdrSize, LPCDPMSG_ENUMSESSIONSREPLY lpcMsg, + DWORD msgSize, LPVOID lpNSInfo ) { DWORD len; lpNSCache lpCache = (lpNSCache)lpNSInfo; lpNSCacheData lpCacheNode; + DWORD maxNameLength; + DWORD nameLength;
TRACE( "%p, %p, %p\n", lpcNSAddrHdr, lpcMsg, lpNSInfo );
+ if ( msgSize < sizeof( DPMSG_ENUMSESSIONSREPLY ) + sizeof( WCHAR ) ) + return; + + maxNameLength = (msgSize - sizeof( DPMSG_ENUMSESSIONSREPLY )) / sizeof( WCHAR ); + nameLength = wcsnlen( (WCHAR *) (lpcMsg + 1), maxNameLength ); + if ( nameLength == maxNameLength ) + return; + /* See if we can find this session. If we can, remove it as it's a dup */ DPQ_REMOVE_ENTRY_CB( lpCache->first, next, data->guidInstance, cbUglyPig, lpcMsg->sd.guidInstance, lpCacheNode ); diff --git a/dlls/dplayx/name_server.h b/dlls/dplayx/name_server.h index 70612ecf00f..b946e9e1fd9 100644 --- a/dlls/dplayx/name_server.h +++ b/dlls/dplayx/name_server.h @@ -32,6 +32,7 @@ void NS_SetLocalComputerAsNameServer( LPCDPSESSIONDESC2 lpsd, LPVOID lpNSInfo ); void NS_AddRemoteComputerAsNameServer( LPCVOID lpNSAddrHdr, DWORD dwHdrSize, LPCDPMSG_ENUMSESSIONSREPLY lpcMsg, + DWORD msgSize, LPVOID lpNSInfo ); LPVOID NS_GetNSAddr( LPVOID lpNSInfo ); DWORD NS_GetNsMagic( LPVOID lpNSInfo );
Hi,
It looks like your patch introduced the new failures shown below. Please investigate and fix them before resubmitting your patch. If they are not new, fixing them anyway would help a lot. Otherwise please ask for the known failures list to be updated.
The tests also ran into some preexisting test failures. If you know how to fix them that would be helpful. See the TestBot job for the details:
The full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=148530
Your paranoid android.
=== debian11 (32 bit hi:IN report) ===
dplayx: dplayx.c:2100: Test failed: recv() returned 54. dplayx.c:2100: Test failed: got mixed 0xfab00036. dplayx.c:2100: Test failed: got password L"".
=== debian11b (64 bit WoW report) ===
kernel32: comm.c:1574: Test failed: AbortWaitCts hComPortEvent failed comm.c:1586: Test failed: Unexpected time 1001, expected around 500
../wine/dlls/dplayx/dplay.c: In function ‘IDirectPlay4Impl_EnumSessions’: ../wine/dlls/dplayx/dplay.c:2534:16: warning: ‘hr’ may be used uninitialized [-Wmaybe-uninitialized] 2534 | return hr; | ^~ ../wine/dlls/dplayx/dplay.c:2477:13: note: ‘hr’ was declared here 2477 | HRESULT hr;
v2: - Fix the uninitialized `hr` warning.
This merge request was approved by Alistair Leslie-Hughes.
-
Alistair Leslie-Hughes (＠alesliehughes) -
Anton Baskanov
-
Anton Baskanov (＠baskanov)
-
Marvin