[PATCH 0/1] MR7051: dinput: Check that the device format data fits in the user format data.

[Rémi Bernon (＠rbernon)]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57568

[PATCH 1/1] dinput: Check that the device format data fits in the user format data.

[Rémi Bernon]

From: Rémi Bernon

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=57568
---
 dlls/dinput/device.c          |  2 +-
 dlls/dinput/tests/joystick8.c | 72 ++++++++++++++++++++++++++++++++++-
 2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/dlls/dinput/device.c b/dlls/dinput/device.c
index 3fc21de4827..4166d18dd8c 100644
--- a/dlls/dinput/device.c
+++ b/dlls/dinput/device.c
@@ -295,7 +295,7 @@ static HRESULT dinput_device_init_user_format( struct dinput_device *impl, const
     user_obj = user_format->rgodf + user_format->dwNumObjs;
     while (user_obj-- > user_format->rgodf) user_obj->dwType &= ~DIDFT_OPTIONAL;

-    if (identical)
+    if (identical && device_format->dwDataSize <= user_format->dwDataSize)
     {
         memcpy( user_format->rgodf, device_format->rgodf, device_format->dwNumObjs * sizeof(*user_format->rgodf) );
         user_format->dwNumObjs = device_format->dwNumObjs;
diff --git a/dlls/dinput/tests/joystick8.c b/dlls/dinput/tests/joystick8.c
index b18fd17c857..30ebdbacaf8 100644
--- a/dlls/dinput/tests/joystick8.c
+++ b/dlls/dinput/tests/joystick8.c
@@ -2660,7 +2660,13 @@ static void test_simple_joystick( DWORD version )
     hr = IDirectInputDevice8_Unacquire( device );
     ok( hr == DI_OK, "Unacquire returned: %#lx\n", hr );

-    dataformat.dwNumObjs = 4;
+
+    dataformat.dwNumObjs = 1;
+    dataformat.dwDataSize = 8;
+    objdataformat[0].pguid = NULL;
+    objdataformat[0].dwOfs = 0;
+    objdataformat[0].dwType = DIDFT_ABSAXIS | DIDFT_MAKEINSTANCE( 6 );
+    objdataformat[0].dwFlags = 0;
     hr = IDirectInputDevice8_SetDataFormat( device, &dataformat );
     ok( hr == DI_OK, "SetDataFormat returned: %#lx\n", hr );
     hr = IDirectInputDevice8_Acquire( device );
@@ -2682,6 +2688,70 @@ static void test_simple_joystick( DWORD version )
     ok( res == WAIT_OBJECT_0, "WaitForSingleObject failed\n" );
     ResetEvent( event );

+    memset( buffer, 0xcd, sizeof(buffer) );
+    hr = IDirectInputDevice8_GetDeviceState( device, dataformat.dwDataSize, buffer );
+    ok( hr == DI_OK, "GetDeviceState returned: %#lx\n", hr );
+    hr = IDirectInputDevice8_Unacquire( device );
+    ok( hr == DI_OK, "Unacquire returned: %#lx\n", hr );
+    ok( ((UINT *)buffer)[0] != 0, "got %#x\n", ((UINT *)buffer)[0] );
+    ok( ((UINT *)buffer)[1] == 0, "got %#x\n", ((UINT *)buffer)[1] );
+    ok( ((UINT *)buffer)[2] == 0xcdcdcdcd, "got %#x\n", ((UINT *)buffer)[2] );
+
+
+    dataformat.dwDataSize = 128;
+    hr = IDirectInputDevice8_SetDataFormat( device, &dataformat );
+    ok( hr == DI_OK, "SetDataFormat returned: %#lx\n", hr );
+    hr = IDirectInputDevice8_Acquire( device );
+    ok( hr == DI_OK, "Unacquire returned: %#lx\n", hr );
+
+    send_hid_input( file, &injected_input[4], sizeof(*injected_input) );
+    res = WaitForSingleObject( event, 100 );
+    if (res == WAIT_TIMEOUT) /* Acquire is asynchronous */
+    {
+        send_hid_input( file, &injected_input[4], sizeof(*injected_input) );
+        res = WaitForSingleObject( event, 100 );
+    }
+    ok( res == WAIT_OBJECT_0, "WaitForSingleObject failed\n" );
+    ResetEvent( event );
+
+    send_hid_input( file, &injected_input[3], sizeof(*injected_input) );
+    res = WaitForSingleObject( event, 5000 );
+    ok( res == WAIT_OBJECT_0, "WaitForSingleObject failed\n" );
+    ResetEvent( event );
+
+    memset( buffer, 0xcd, sizeof(buffer) );
+    hr = IDirectInputDevice8_GetDeviceState( device, dataformat.dwDataSize, buffer );
+    ok( hr == DI_OK, "GetDeviceState returned: %#lx\n", hr );
+    hr = IDirectInputDevice8_Unacquire( device );
+    ok( hr == DI_OK, "Unacquire returned: %#lx\n", hr );
+    ok( ((UINT *)buffer)[0] != 0, "got %#x\n", ((UINT *)buffer)[0] );
+    ok( ((UINT *)buffer)[1] != 0, "got %#x\n", ((UINT *)buffer)[1] );
+    ok( ((UINT *)buffer)[2] != 0, "got %#x\n", ((UINT *)buffer)[2] );
+
+    objdataformat[0].dwType = DIDFT_AXIS | DIDFT_MAKEINSTANCE( 0 );
+
+
+    dataformat.dwNumObjs = 4;
+    hr = IDirectInputDevice8_SetDataFormat( device, &dataformat );
+    ok( hr == DI_OK, "SetDataFormat returned: %#lx\n", hr );
+    hr = IDirectInputDevice8_Acquire( device );
+    ok( hr == DI_OK, "Unacquire returned: %#lx\n", hr );
+
+    send_hid_input( file, &injected_input[4], sizeof(*injected_input) );
+    res = WaitForSingleObject( event, 100 );
+    if (res == WAIT_TIMEOUT) /* Acquire is asynchronous */
+    {
+        send_hid_input( file, &injected_input[4], sizeof(*injected_input) );
+        res = WaitForSingleObject( event, 100 );
+    }
+    ok( res == WAIT_OBJECT_0, "WaitForSingleObject failed\n" );
+    ResetEvent( event );
+
+    send_hid_input( file, &injected_input[3], sizeof(*injected_input) );
+    res = WaitForSingleObject( event, 5000 );
+    ok( res == WAIT_OBJECT_0, "WaitForSingleObject failed\n" );
+    ResetEvent( event );
+
     hr = IDirectInputDevice8_GetDeviceState( device, dataformat.dwDataSize, buffer );
     ok( hr == DI_OK, "GetDeviceState returned: %#lx\n", hr );
     ok( ((ULONG *)buffer)[0] == 0x512b, "got %#lx, expected %#x\n", ((ULONG *)buffer)[0], 0x512b );