Skip to content

W
wine-winehq
Commit 23e0d22b authored by Zebediah Figura's avatar Zebediah Figura Committed by Alexandre Julliard
Browse files
Options

mshtml: Avoid passing invalid memory to DispCallFunc().

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47222Signed-off-by: 's avatarZebediah Figura <z.figura12@gmail.com> Signed-off-by: 's avatarJacek Caban <jacek@codeweavers.com> Signed-off-by: 's avatarAlexandre Julliard <julliard@winehq.org>
parent f8fffe9e
Hide whitespace changes
Inline Side-by-side
Showing with 12 additions and 6 deletions
dlls/mshtml/dispex.c
View file @ 23e0d22b
......@@ -295,22 +295,28 @@ static void add_func_info(dispex_data_t *data, tid_t tid, const FUNCDESC *desc,
assert(info->argc < MAX_ARGS);
assert(desc->funckind == FUNC_DISPATCH);
info->arg_types = heap_alloc(sizeof(*info->arg_types) * info->argc);
if(!info->arg_types)
return;
info->arg_info = heap_alloc_zero(sizeof(*info->arg_info) * info->argc);
if(!info->arg_info)
return;
for(i=0; i < info->argc; i++)
info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
info->prop_vt = desc->elemdescFunc.tdesc.vt;
if(info->prop_vt != VT_VOID && info->prop_vt != VT_PTR && !is_arg_type_supported(info->prop_vt)) {
TRACE("%s: return type %d\n", debugstr_w(info->name), info->prop_vt);
return; /* Fallback to ITypeInfo::Invoke */
}
info->arg_types = heap_alloc(sizeof(*info->arg_types) * (info->argc + (info->prop_vt == VT_VOID ? 0 : 1)));
if(!info->arg_types)
return;
for(i=0; i < info->argc; i++)
info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
if(info->prop_vt == VT_PTR)
info->arg_types[info->argc] = VT_BYREF | VT_DISPATCH;
else if(info->prop_vt != VT_VOID)
info->arg_types[info->argc] = VT_BYREF | info->prop_vt;
if(desc->cParamsOpt) {
TRACE("%s: optional params\n", debugstr_w(info->name));
return; /* Fallback to ITypeInfo::Invoke */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment