[PATCH 2/2] user32: Fix NULL dereference in UnregisterDeviceNotification

Arkadiusz Hiler arek at hiler.eu
Tue May 26 15:01:36 CDT 2020


UnregisterDeviceNotification when provided with NULL should not try to
dereference it and just return FALSE.

This fixes crashes in BandLab Cakewalk and Glorious Model O control software.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=49211
Signed-off-by: Arkadiusz Hiler <arek at hiler.eu>
---
 dlls/sechost/service.c    | 3 +++
 dlls/user32/tests/input.c | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/dlls/sechost/service.c b/dlls/sechost/service.c
index 924a6c9264..68d2b9e78e 100644
--- a/dlls/sechost/service.c
+++ b/dlls/sechost/service.c
@@ -2109,6 +2109,9 @@ BOOL WINAPI I_ScUnregisterDeviceNotification( HDEVNOTIFY handle )
 
     TRACE("%p\n", handle);
 
+    if (!handle)
+        return FALSE;
+
     EnterCriticalSection( &service_cs );
     list_remove( &registration->entry );
     LeaveCriticalSection(&service_cs);
diff --git a/dlls/user32/tests/input.c b/dlls/user32/tests/input.c
index 92b18becd2..913fabfbd8 100644
--- a/dlls/user32/tests/input.c
+++ b/dlls/user32/tests/input.c
@@ -3004,6 +3004,12 @@ static void test_GetPointerType(void)
     ok(type == PT_MOUSE, " type %d\n", type );
 }
 
+static void test_UnregisterDeviceNotification(void)
+{
+    BOOL ret = UnregisterDeviceNotification(NULL);
+    ok(ret == FALSE, "Unregistering NULL Device Notification returned: %d\n", ret);
+}
+
 START_TEST(input)
 {
     POINT pos;
@@ -3050,4 +3056,6 @@ START_TEST(input)
         test_GetPointerType();
     else
         win_skip("GetPointerType is not available\n");
+
+    test_UnregisterDeviceNotification();
 }
-- 
2.26.2




More information about the wine-devel mailing list