Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
W
wine-winehq
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
wine
wine-winehq
Commits
13b65faf
Commit
13b65faf
authored
Apr 18, 2015
by
Thomas Faber
Committed by
Alexandre Julliard
Apr 20, 2015
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
comctl32: Avoid use-after-free in DPA_Merge (DPH).
parent
7c85ed6a
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
3 additions
and
9 deletions
+3
-9
dpa.c
dlls/comctl32/dpa.c
+3
-9
No files found.
dlls/comctl32/dpa.c
View file @
13b65faf
...
...
@@ -303,16 +303,14 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
hdpa1
->
nItemCount
,
hdpa2
->
nItemCount
);
/* working but untrusted implementation */
pWork1
=
&
(
hdpa1
->
ptrs
[
hdpa1
->
nItemCount
-
1
]);
pWork2
=
&
(
hdpa2
->
ptrs
[
hdpa2
->
nItemCount
-
1
]);
nIndex
=
hdpa1
->
nItemCount
-
1
;
nCount
=
hdpa2
->
nItemCount
-
1
;
do
{
pWork1
=
&
hdpa1
->
ptrs
[
nIndex
];
pWork2
=
&
hdpa2
->
ptrs
[
nCount
];
if
(
nIndex
<
0
)
{
if
((
nCount
>=
0
)
&&
(
dwFlags
&
DPAM_UNION
))
{
/* Now insert the remaining new items into DPA 1 */
...
...
@@ -343,10 +341,8 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
return
FALSE
;
nCount
--
;
pWork2
--
;
*
pWork1
=
ptr
;
nIndex
--
;
pWork1
--
;
}
else
if
(
nResult
>
0
)
{
...
...
@@ -361,7 +357,6 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
(
pfnMerge
)(
DPAMM_DELETE
,
ptr
,
NULL
,
lParam
);
}
nIndex
--
;
pWork1
--
;
}
else
{
...
...
@@ -377,7 +372,6 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags,
DPA_InsertPtr
(
hdpa1
,
nIndex
+
1
,
ptr
);
}
nCount
--
;
pWork2
--
;
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment