Paul Gofman : winhttp: Don't allow queueing websocket receive if another is pending.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: d44e752fa26403b41da7d7c6ac34b2884f287984
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=d44e752fa26403b41da7d7c6ac34b2884f287984

Author: Paul Gofman <pgofman at codeweavers.com>
Date:   Fri Jan 28 02:06:31 2022 +0300

winhttp: Don't allow queueing websocket receive if another is pending.

Signed-off-by: Paul Gofman <pgofman at codeweavers.com>
Signed-off-by: Hans Leidekker <hans at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/winhttp/request.c            | 15 +++++++++++++--
 dlls/winhttp/tests/notification.c |  2 ++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/dlls/winhttp/request.c b/dlls/winhttp/request.c
index a61355da7b9..728b1895ba7 100644
--- a/dlls/winhttp/request.c
+++ b/dlls/winhttp/request.c
@@ -3743,13 +3743,24 @@ DWORD WINAPI WinHttpWebSocketReceive( HINTERNET hsocket, void *buf, DWORD len, D
     {
         struct socket_receive *r;
 
-        if (!(r = malloc( sizeof(*r) ))) return FALSE;
+        if (InterlockedIncrement( &socket->hdr.pending_receives ) > 1)
+        {
+            InterlockedDecrement( &socket->hdr.pending_receives );
+            WARN( "Attempt to queue receive while another is pending.\n" );
+            release_object( &socket->hdr );
+            return ERROR_INVALID_OPERATION;
+        }
+
+        if (!(r = malloc( sizeof(*r) )))
+        {
+            InterlockedDecrement( &socket->hdr.pending_receives );
+            return ERROR_OUTOFMEMORY;
+        }
         r->socket = socket;
         r->buf    = buf;
         r->len    = len;
 
         addref_object( &socket->hdr );
-        InterlockedIncrement( &socket->hdr.pending_receives );
         if ((ret = queue_task( &socket->recv_q, task_socket_receive, r )))
         {
             InterlockedDecrement( &socket->hdr.pending_receives );
diff --git a/dlls/winhttp/tests/notification.c b/dlls/winhttp/tests/notification.c
index fabc5a03a46..121190ba9d2 100644
--- a/dlls/winhttp/tests/notification.c
+++ b/dlls/winhttp/tests/notification.c
@@ -1104,6 +1104,8 @@ static void test_websocket(BOOL secure)
 
     err = pWinHttpWebSocketReceive( socket, buffer, sizeof(buffer), &size, &type );
     ok( err == ERROR_SUCCESS, "got %u\n", err );
+    err = pWinHttpWebSocketReceive( socket, buffer, sizeof(buffer), &size, &type );
+    ok( err == ERROR_INVALID_OPERATION, "got %u\n", err );
 
     setup_test( &info, winhttp_websocket_shutdown, __LINE__ );
     ws_status = (WINHTTP_WEB_SOCKET_STATUS *)info.buffer;