Zebediah Figura : mshtml: Avoid passing invalid memory to DispCallFunc().
Alexandre Julliard
julliard at winehq.org
Mon May 20 15:50:48 CDT 2019
Module: wine
Branch: master
Commit: 23e0d22b7c8c350b47e76c611218a4e7ff5ac570
URL: https://source.winehq.org/git/wine.git/?a=commit;h=23e0d22b7c8c350b47e76c611218a4e7ff5ac570
Author: Zebediah Figura <z.figura12 at gmail.com>
Date: Mon May 20 10:33:25 2019 -0500
mshtml: Avoid passing invalid memory to DispCallFunc().
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47222
Signed-off-by: Zebediah Figura <z.figura12 at gmail.com>
Signed-off-by: Jacek Caban <jacek at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/mshtml/dispex.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index 2033e90..4363067 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -295,22 +295,28 @@ static void add_func_info(dispex_data_t *data, tid_t tid, const FUNCDESC *desc,
assert(info->argc < MAX_ARGS);
assert(desc->funckind == FUNC_DISPATCH);
- info->arg_types = heap_alloc(sizeof(*info->arg_types) * info->argc);
- if(!info->arg_types)
- return;
info->arg_info = heap_alloc_zero(sizeof(*info->arg_info) * info->argc);
if(!info->arg_info)
return;
- for(i=0; i < info->argc; i++)
- info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
-
info->prop_vt = desc->elemdescFunc.tdesc.vt;
if(info->prop_vt != VT_VOID && info->prop_vt != VT_PTR && !is_arg_type_supported(info->prop_vt)) {
TRACE("%s: return type %d\n", debugstr_w(info->name), info->prop_vt);
return; /* Fallback to ITypeInfo::Invoke */
}
+ info->arg_types = heap_alloc(sizeof(*info->arg_types) * (info->argc + (info->prop_vt == VT_VOID ? 0 : 1)));
+ if(!info->arg_types)
+ return;
+
+ for(i=0; i < info->argc; i++)
+ info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
+
+ if(info->prop_vt == VT_PTR)
+ info->arg_types[info->argc] = VT_BYREF | VT_DISPATCH;
+ else if(info->prop_vt != VT_VOID)
+ info->arg_types[info->argc] = VT_BYREF | info->prop_vt;
+
if(desc->cParamsOpt) {
TRACE("%s: optional params\n", debugstr_w(info->name));
return; /* Fallback to ITypeInfo::Invoke */
More information about the wine-cvs
mailing list