1. 12 Oct, 2022 35 commits
  2. 11 Oct, 2022 5 commits
    • Mark Jansen's avatar
      gdi32: Fix possible overflow. · 4312be16
      Mark Jansen authored
      According to the documentation of ScriptShape function, the psva argument should have the number of elements indicated by cMaxGlyphs.
      4312be16
    • Alexandre Julliard's avatar
      46f30707
    • Francois Gouget's avatar
    • Kevin Puetz's avatar
      rpcrt4: Add a refcount owned by MIDL_STUB_MESSAGE. · a7be4256
      Kevin Puetz authored
      In cases where this could have been use-after-free, exceptions were
      caught/hidden by RpcTryFinally, but still lead to leaks since
      NdrProxyFreeBuffer wasn't able to call IRPCChannelBuffer::FreeBuffer.
      
      StdProxy_GetChannel() now AddRef() on its return value (used to set
      __proxy_frame::_StubMsg::pRpcChannelBuffer), and NdrProxyFreeBuffer()
      calls the corresponding Release() and clears the now-weak pointer.
      This makes the behavior of these function match the observed test
      results, and fixes the crash/leak when a proxy is released mid-Invoke.
      a7be4256
    • Kevin Puetz's avatar
      rpcrt4/tests: Add tests for lifetime of IRpcChannelBuffer. · 59f39b32
      Kevin Puetz authored
      It's possible for a proxy to be released during the middle of an Invoke.
      E.g. a specific case where this happened was a single-shot event sink
      which, upon receiving the event it was waiting for, would immediately
      call DispEventUnadvise. This removed the proxy pointing to that sink
      from the connection point's list of subscribers and released the last
      refcount on the proxy itself.
      
      Therefore, all state used to complete an RPC call must be on the stack;
      once NdrProxySendReceive pumps STA messages and permits reentrancy,
      the proxy cannot be accessed or relied on to own anything.
      
      Add test showing MIDL_STUB_MESSAGE::pRpcChannelBuffer owns a refcount
      (to ensure it can read [out] parameters from the channel)
      59f39b32