[PATCH v2 3/3] kernelbase: Pass va_list copy to internal RtlFormatMessage.
Daniel Lehman
wine at gitlab.winehq.org
Mon Jun 13 15:59:47 CDT 2022
From: Daniel Lehman <dlehman25 at gmail.com>
va_list passed to RtlFormatMessage is modified even on error in this
case, if the buffer is not large enough, STATUS_BUFFER_OVERFLOW is
returned and FormatMessage tries again, but the va_list pointer is now
moved to a later argument, so the next call reads off the end,
crashing.
Signed-off-by: Daniel Lehman <dlehman25 at gmail.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/kernelbase/locale.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/dlls/kernelbase/locale.c b/dlls/kernelbase/locale.c
index 257d9f693ba..0c20c858a7a 100644
--- a/dlls/kernelbase/locale.c
+++ b/dlls/kernelbase/locale.c
@@ -5457,6 +5457,7 @@ DWORD WINAPI DECLSPEC_HOTPATCH FormatMessageW( DWORD flags, const void *source,
if (flags & FORMAT_MESSAGE_ALLOCATE_BUFFER)
{
WCHAR *result;
+ va_list args_copy;
ULONG alloc = max( size * sizeof(WCHAR), 65536 );
for (;;)
@@ -5466,9 +5467,17 @@ DWORD WINAPI DECLSPEC_HOTPATCH FormatMessageW( DWORD flags, const void *source,
status = STATUS_NO_MEMORY;
break;
}
- status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
- FALSE, !!(flags & FORMAT_MESSAGE_ARGUMENT_ARRAY), args,
- result, alloc, &retsize );
+ if (args && !(flags & FORMAT_MESSAGE_ARGUMENT_ARRAY))
+ {
+ va_copy( args_copy, *args );
+ status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
+ FALSE, FALSE, &args_copy, result, alloc, &retsize );
+ va_end( args_copy );
+ }
+ else
+ status = RtlFormatMessage( src, width, !!(flags & FORMAT_MESSAGE_IGNORE_INSERTS),
+ FALSE, TRUE, args, result, alloc, &retsize );
+
if (!status)
{
if (retsize <= sizeof(WCHAR)) HeapFree( GetProcessHeap(), 0, result );
--
GitLab
https://gitlab.winehq.org/wine/wine/-/merge_requests/187
More information about the wine-devel
mailing list