[PATCH 0/2] MR8596: dsound: Check if 'cbPropData' for DSPROPERTY_Description1 is large enough

[Yeshun Ye (＠yeyeshun)]

Avoid writing out of bounds.

Signed-off-by: YeshunYe

[PATCH 1/2] dsound: Check if 'cbPropData' for DSPROPERTY_Description1 is large enough

[YeshunYe]

From: YeshunYe

Avoid writing out of bounds.

Signed-off-by: YeshunYe 
---
 dlls/dsound/propset.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dlls/dsound/propset.c b/dlls/dsound/propset.c
index be284a6dda5..28df7887f65 100644
--- a/dlls/dsound/propset.c
+++ b/dlls/dsound/propset.c
@@ -475,6 +475,8 @@ static HRESULT DSPROPERTY_Description1(
         *pcbReturned = sizeof(*ppd);
     if (!pPropData)
         return S_OK;
+    if (cbPropData < sizeof(*ppd))
+        return E_INVALIDARG;

data.DeviceId = ppd->DeviceId;
     data.DataFlow = ppd->DataFlow;

[PATCH 2/2] dsound/tests: Test DSPROPERTY_DIRECTSOUNDDEVICE_DESCRIPTION_1 with small size

[YeshunYe]

From: YeshunYe

Signed-off-by: YeshunYe 
---
 dlls/dsound/tests/propset.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/dlls/dsound/tests/propset.c b/dlls/dsound/tests/propset.c
index 71040a70c77..659a9694851 100644
--- a/dlls/dsound/tests/propset.c
+++ b/dlls/dsound/tests/propset.c
@@ -300,6 +300,20 @@ static void propset_private_tests(void)
        "Shouldn't be able to set DSPROPERTY_DIRECTSOUNDDEVICE_DESCRIPTION_1: "
        "support = 0x%lx\n",support);

+    if (support & KSPROPERTY_SUPPORT_GET) {
+        struct
+        {
+            GUID DeviceId;
+            int  reserved;
+        } data;
+        ULONG bytes;
+        data.DeviceId = DSDEVID_DefaultPlayback;
+
+        rc = IKsPropertySet_Get(pps, &DSPROPSETID_DirectSoundDevice,
+                              DSPROPERTY_DIRECTSOUNDDEVICE_DESCRIPTION_1,
+                              NULL, 0, &data, sizeof(data), &bytes);
+        ok(rc==E_INVALIDARG, "Query buffer size failed: 0x%lx\n",rc);
+    }
     /* test DSPROPERTY_DIRECTSOUNDDEVICE_DESCRIPTION_A */
     rc = IKsPropertySet_QuerySupport(pps, &DSPROPSETID_DirectSoundDevice,
                                    DSPROPERTY_DIRECTSOUNDDEVICE_DESCRIPTION_A,

[Huw Davies (＠huw)]

Is there an application that needs this?

[Yeshun Ye (＠yeyeshun)]

On Mon Jul 21 00:51:15 2025 +0000, Huw Davies wrote:
> Is there an application that needs this?

When I ran KuGou Music using Wine, since the builtin quartz was missing a COM interface, I set it to native instead.    
After doing this, the program could continue running, but it caused a stack corruption error.

Through continuous log analysis, the error was traced to a call to IKsPrivatePropertySetImpl_Get in native quartz, with parameter combinations exactly like those shown in my test case.

[Huw Davies (＠huw)]

Huw Davies (@huw) commented about dlls/dsound/tests/propset.c:
>     "Shouldn't be able to set DSPROPERTY_DIRECTSOUNDDEVICE_DESCRIPTION_1: "
>     "support = 0x%lx\n",support);
>
> - if (support & KSPROPERTY_SUPPORT_GET) {
> -
>    struct
> -
>    {
> -
>        GUID DeviceId;
> -
>        int  reserved;
> -
>    } data;

Could we just use `DSPROPERTY_DIRECTSOUNDDEVICE_DESCRIPTION_1_DATA` here and pass `sizeof(data) - 1` to the method call?  Let's also pass the correct size and test for success.