Fix crash due to NULL pointer in ntdll timer funcs

Jukka Heinonen jhei at iki.fi
Sat May 24 01:48:28 CDT 2003


Ntdll timer routines did not check for NULL ObjectName
in OBJECT_ATTRIBUTES even though kernel32 timer routines
did use those for unnamed timers. This made Wine to crash
whenever unnamed timers were created.





Changelog:
    Ntdll timer routines must check for NULL timer name.





Index: dlls/ntdll/sync.c
===================================================================
RCS file: /home/wine/wine/dlls/ntdll/sync.c,v
retrieving revision 1.28
diff -u -r1.28 sync.c
--- dlls/ntdll/sync.c	20 May 2003 04:00:42 -0000	1.28
+++ dlls/ntdll/sync.c	24 May 2003 06:30:20 -0000
@@ -297,6 +297,7 @@
                               IN const OBJECT_ATTRIBUTES *oa OPTIONAL,
                               IN TIMER_TYPE timer_type)
 {
+    DWORD len = (oa && oa->ObjectName) ? oa->ObjectName->Length : 0;
     NTSTATUS    status;
 
     if (timer_type != NotificationTimer && timer_type != SynchronizationTimer)
@@ -306,8 +307,7 @@
     {
         req->manual  = (timer_type == NotificationTimer) ? TRUE : FALSE;
         req->inherit = oa && (oa->Attributes & OBJ_INHERIT);
-        if (oa && oa->ObjectName->Length)
-            wine_server_add_data( req, oa->ObjectName->Buffer, oa->ObjectName->Length );
+        if (len) wine_server_add_data( req, oa->ObjectName->Buffer, len );
         status = wine_server_call( req );
         *handle = reply->handle;
     }
@@ -324,6 +324,7 @@
                             IN ACCESS_MASK access,
                             IN const OBJECT_ATTRIBUTES* oa )
 {
+    DWORD len = (oa && oa->ObjectName) ? oa->ObjectName->Length : 0;
     NTSTATUS status;
 
     if (oa && oa->Length >= MAX_PATH * sizeof(WCHAR))
@@ -333,8 +334,7 @@
     {
         req->access  = access;
         req->inherit = oa && (oa->Attributes & OBJ_INHERIT);
-        if (oa && oa->ObjectName->Length)
-            wine_server_add_data( req, oa->ObjectName->Buffer, oa->ObjectName->Length );
+        if (len) wine_server_add_data( req, oa->ObjectName->Buffer, len );
         status = wine_server_call( req );
         *handle = reply->handle;
     }




-- 
Jukka Heinonen <http://www.iki.fi/jhei/>



More information about the wine-patches mailing list