[PATCH 1/2] user32: Store pointer to timer callback in SetTimer function instead of treating it as window procedure

[Piotr Caban]

On 03/03/16 06:42, Alexandre Julliard wrote:
> The more likely case is a 16-bit app retrieving a 32-bit timer and
> calling it through DispatchMessage16. How is this going to work with
> your proposed changes?
As far as I can see it should not work. I'm attaching a compiled 16-bit 
application that tries to do it. All tests were done on Windows XP, I 
guess Windows 95/98 may behave differently. set_timer.c was compiled 
using mingw-w64, ttimer.c using openwatcom.

There are following executables:
ttimer.exe - 16-bit application, that creates window, calls 
set_timer.dll->set_timer and pumps messages
set_timer.dll - 32-bit dll that exports set_timer(HWND, DWORD *count) 
function, it sets timer on window and increases count when callback is 
called.

Here's the output of the application on Windows XP (without first few 
lines that are not important):
ttimer.c:214:set_timer 32-bit callback pointer 10001010 (0 means error)
ttimer.c:216:For some reason GetMessage32 is always failing on windows: 0
ttimer.c:217:For some reason GetMessage32 is always failing on windows: 0

ttimer.c:220:Checking SetTimer32/GetMessage16/DispatchMessage16:
ttimer.c:224:hwnd 0158 msg c09c lparam 28
ttimer.c:224:hwnd 015a msg 113 lparam 10001010
ttimer.c:229:timer callback was called 0 times, expected 0

ttimer.c:231:Checking SetTimer32/GetMessage16/DispatchMessage32:
ttimer.c:235:hwnd 0158 msg c09f lparam 1
ttimer.c:235:hwnd 0158 msg c09c lparam 28
ttimer.c:235:hwnd 015a msg 113 lparam 10001010
ttimer.c:240:timer callback was called 0 times, expected 0

ttimer.c:242:Checking SetTimer32/GetMessage16/DispatchMessage32(wParamHigh):
ttimer.c:246:hwnd 0156 msg 101 lparam c01c0001
ttimer.c:246:hwnd 015a msg 113 lparam 10001010
ttimer.c:253:timer callback was called 0 times, expected 0

The lParam parameter of WM_TIMER message contains 32-bit pointer to 
callback function (not some kind of handle). DispatchMessage{16/32} is 
not calling this callback. On windows there's no crash in this case 
(while there is in wine with my patches).

I've also checked what's in WM_TIMER message when SetTimer16 is used. It 
turns out windows simply passes function far pointer in LPARAM in this 
case as well.

I've also tries calling DispatchMessage16 on WM_TIMER message with 
incorrect callback pointer. It crashes on wine, doesn't crash on windows.

Please let me know if anything else should be tested.

Thanks,
Piotr
-------------- next part --------------
A non-text attachment was scrubbed...
Name: set_timer.c
Type: text/x-csrc
Size: 314 bytes
Desc: not available
URL: <http://www.winehq.org/pipermail/wine-devel/attachments/20160303/dc6ed91b/attachment-0002.c>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: set_timer.dll
Type: application/x-msdos-program
Size: 37250 bytes
Desc: not available
URL: <http://www.winehq.org/pipermail/wine-devel/attachments/20160303/dc6ed91b/attachment-0001.dll>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ttimer.c
Type: text/x-csrc
Size: 4104 bytes
Desc: not available
URL: <http://www.winehq.org/pipermail/wine-devel/attachments/20160303/dc6ed91b/attachment-0003.c>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ttimer.exe
Type: application/x-msdos-program
Size: 38624 bytes
Desc: not available
URL: <http://www.winehq.org/pipermail/wine-devel/attachments/20160303/dc6ed91b/attachment-0001.exe>