[PATCH v2 0/1] MR7065: comctl32/tests: Use sufficient user data buffer in the Tab tests (ASan)

[Nikolay Sivov (＠nsivov)]

The issue here is that TCITEM is not enough to hold lparam over sizeof(LPARAM).

--
  v2: comctl32/tests: Use sufficient user data buffer in the Tab tests (ASan)

https://gitlab.winehq.org/wine/wine/-/merge_requests/7065

[PATCH v2 1/1] comctl32/tests: Use sufficient user data buffer in the Tab tests (ASan)

[Bernhard Übelacker]

From: Bernhard Übelacker

Signed-off-by: Nikolay Sivov 
---
 dlls/comctl32/tests/tab.c | 35 ++++++++++++++++-------------------
 1 file changed, 16 insertions(+), 19 deletions(-)

diff --git a/dlls/comctl32/tests/tab.c b/dlls/comctl32/tests/tab.c
index 2e6767a06d5..3e6a365ef80 100644
--- a/dlls/comctl32/tests/tab.c
+++ b/dlls/comctl32/tests/tab.c
@@ -1379,9 +1379,12 @@ static void test_TCM_SETITEMEXTRA(void)

static void test_TCS_OWNERDRAWFIXED(void)
 {
-    LPARAM lparam;
-    ULONG_PTR itemdata, itemdata2;
-    TCITEMA item;
+    struct
+    {
+        TCITEMHEADERA h;
+        BYTE lparam[sizeof(LPARAM)+1];
+    } item;
+    ULONG_PTR itemdata;
     HWND hTab;
     BOOL ret;

@@ -1390,11 +1393,8 @@ static void test_TCS_OWNERDRAWFIXED(void)

ok(GetParent(hTab) == NULL, "got %p, expected null parent\n", GetParent(hTab));

-    /* set some item data */
-    memset(&lparam, 0xde, sizeof(LPARAM));
-
-    item.mask = TCIF_PARAM;
-    item.lParam = lparam;
+    item.h.mask = TCIF_PARAM;
+    memset(item.lparam, 0xde, sizeof(LPARAM));
     ret = SendMessageA(hTab, TCM_SETITEMA, 0, (LPARAM)&item);
     ok(ret == TRUE, "got %d\n", ret);

@@ -1423,9 +1423,8 @@ static void test_TCS_OWNERDRAWFIXED(void)
     ok(ret == TRUE, "got %d\n", ret);

/* set some item data */
-    memset(&lparam, 0xde, sizeof(LPARAM));
-    item.mask = TCIF_PARAM;
-    item.lParam = lparam;
+    item.h.mask = TCIF_PARAM;
+    memset(item.lparam, 0xde, sizeof(item.lparam));

ret = SendMessageA(hTab, TCM_INSERTITEMA, 0, (LPARAM)&item);
     ok(ret == 0, "got %d\n", ret);
@@ -1453,9 +1452,8 @@ static void test_TCS_OWNERDRAWFIXED(void)
     ret = SendMessageA(hTab, TCM_SETITEMEXTRA, sizeof(LPARAM)-1, 0);
     ok(ret == TRUE, "got %d\n", ret);

-    memset(&lparam, 0xde, sizeof(lparam));
-    item.mask = TCIF_PARAM;
-    item.lParam = lparam;
+    item.h.mask = TCIF_PARAM;
+    memset(item.lparam, 0xde, sizeof(LPARAM));

ret = SendMessageA(hTab, TCM_INSERTITEMA, 0, (LPARAM)&item);
     ok(ret == 0, "got %d\n", ret);
@@ -1465,11 +1463,10 @@ static void test_TCS_OWNERDRAWFIXED(void)
     ShowWindow(hTab, SW_SHOW);
     RedrawWindow(hTab, NULL, 0, RDW_UPDATENOW);

-    itemdata = itemdata2 = 0;
-    memset(&itemdata, 0xde, 4);
-    memset(&itemdata2, 0xde, sizeof(LPARAM)-1);
-    ok(g_drawitem.itemData == itemdata || broken(g_drawitem.itemData == itemdata2) /* win98 */,
-        "got 0x%Ix, expected 0x%Ix\n", g_drawitem.itemData, itemdata);
+    itemdata = 0;
+    memset(&itemdata, 0xde, min(4, sizeof(LPARAM)-1));
+    todo_wine_if(sizeof(void *) == 4)
+    ok(g_drawitem.itemData == itemdata, "got 0x%Ix, expected 0x%Ix\n", g_drawitem.itemData, itemdata);

DestroyWindow(hTab);
 }

[Nikolay Sivov (＠nsivov)]

v2: adjusted test a bit to reflect what's happening with extra size below sizeof(LPARAM).

[Zhiyi Zhang (＠zhiyi)]

> The issue here is that TCITEM is not enough to hold lparam over sizeof(LPARAM).

This message is misleading. Shouldn't it be TCITEM is not enough to hold the extra item size sizeof(LPARAM)+1? For the "SendMessageA(hTab, TCM_SETITEMEXTRA, sizeof(LPARAM)+1, 0)" call?

[PATCH v2 0/1] MR7065: comctl32/tests: Use sufficient user data buffer in the Tab tests (ASan) - approved

[Zhiyi Zhang (＠zhiyi)]

This merge request was approved by Zhiyi Zhang.