riched20: Add check to ensure iob is a valid index into the object array.

Signed-off-by: Nikolay Sivov <nsivov@codeweavers.com> Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

riched20: Add check to ensure iob is a valid index into the object array.
0762f672 · Ulrich Czekalla · Alexandre Julliard · c2daea89 · 0762f672 · 0762f672
Commit 0762f672 authored Jan 15, 2021 by Ulrich Czekalla Committed by Alexandre Julliard Jan 18, 2021
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 1 deletion

richole.c dlls/riched20/richole.c +1 -1

richole.c dlls/riched20/tests/richole.c +6 -0

No files found.
--- a/dlls/riched20/richole.c
+++ b/dlls/riched20/richole.c
@@ -1407,7 +1407,7 @@ IRichEditOle_fnGetObject(IRichEditOle *me, LONG iob,
    }
    else
    {
-        if (iob > IRichEditOle_GetObjectCount(me))
+        if (iob < 0 || iob >= IRichEditOle_GetObjectCount(me))
            return E_INVALIDARG;
        LIST_FOR_EACH_ENTRY(reobj, &This->editor->reobj_list, struct re_object, entry)
        {

--- a/dlls/riched20/tests/richole.c
+++ b/dlls/riched20/tests/richole.c
@@ -3296,12 +3296,18 @@ static void test_InsertObject(void)
  ok(hr == S_OK, "IRichEditOle_GetObject failed: 0x%08x\n", hr);
  CHECK_REOBJECT_STRUCT(received_reo4, NULL, NULL, reo2.polesite, 2);

+  hr = IRichEditOle_GetObject(reole, 3, &received_reo4, REO_GETOBJ_POLESITE);
+  ok(hr == E_INVALIDARG, "IRichEditOle_GetObject should fail: 0x%08x\n", hr);
+
  hr = IRichEditOle_GetObject(reole, 4, &received_reo4, REO_GETOBJ_POLESITE);
  ok(hr == E_INVALIDARG, "IRichEditOle_GetObject should fail: 0x%08x\n", hr);

  hr = IRichEditOle_GetObject(reole, 1024, &received_reo4, REO_GETOBJ_POLESITE);
  ok(hr == E_INVALIDARG, "IRichEditOle_GetObject should fail: 0x%08x\n", hr);

+  hr = IRichEditOle_GetObject(reole, -10, &received_reo4, REO_GETOBJ_POLESITE);
+  ok(hr == E_INVALIDARG, "IRichEditOle_GetObject should fail: 0x%08x\n", hr);
+
  /* received_reo4 will be zeroed before be used */
  hr = IRichEditOle_GetObject(reole, 2, &received_reo4, REO_GETOBJ_NO_INTERFACES);
  ok(hr == S_OK, "IRichEditOle_GetObject failed: 0x%08x\n", hr);