niansa-misc/wine
1
0
Fork 0
mirror of synced 2025-03-07 03:53:26 +01:00
Code Issues Projects Releases Packages Wiki Activity

kernel32: Add ACTCTX field limit checks to CreateActCtxA().

Browse source 
Signed-off-by: Dmitry Timoshkov <dmitry@baikal.ru>
This commit is contained in:
Dmitry Timoshkov 2023-09-14 15:14:38 +03:00 • committed by Alexandre Julliard
parent 54479863ce
commit e8ce99792e
2 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
dlls/kernel32/process.c
View file

@ -422,11 +422,19 @@ HANDLE WINAPI DECLSPEC_HOTPATCH CreateActCtxA( const ACTCTXA *actctx )
TRACE("%p %08lx\n", actctx, actctx ? actctx->dwFlags : 0);
if (!actctx || actctx->cbSize != sizeof(*actctx))
#define CHECK_LIMIT( field ) (actctx->cbSize >= RTL_SIZEOF_THROUGH_FIELD( ACTCTXA, field ))
if (!actctx || !CHECK_LIMIT( lpSource ) ||
((actctx->dwFlags & ACTCTX_FLAG_PROCESSOR_ARCHITECTURE_VALID) && !CHECK_LIMIT( wProcessorArchitecture )) ||
((actctx->dwFlags & ACTCTX_FLAG_LANGID_VALID) && !CHECK_LIMIT( wLangId )) ||
((actctx->dwFlags & ACTCTX_FLAG_ASSEMBLY_DIRECTORY_VALID) && !CHECK_LIMIT( lpAssemblyDirectory )) ||
((actctx->dwFlags & ACTCTX_FLAG_RESOURCE_NAME_VALID) && !CHECK_LIMIT( lpResourceName )) ||
((actctx->dwFlags & ACTCTX_FLAG_APPLICATION_NAME_VALID) && !CHECK_LIMIT( lpApplicationName )) ||
((actctx->dwFlags & ACTCTX_FLAG_HMODULE_VALID) && !CHECK_LIMIT( hModule )))
{
SetLastError(ERROR_INVALID_PARAMETER);
return INVALID_HANDLE_VALUE;
}
#undef CHECK_LIMIT
actw.cbSize = sizeof(actw);
actw.dwFlags = actctx->dwFlags;

2
dlls/kernel32/tests/actctx.c
View file

@ -2895,7 +2895,6 @@ static void test_CreateActCtx(void)
handle = CreateActCtxA(&actctx);
if (!test[i].error)
{
todo_wine
ok(handle != INVALID_HANDLE_VALUE, "CreateActCtx error %lu\n", GetLastError());
ReleaseActCtx(handle);
}
@ -2910,7 +2909,6 @@ static void test_CreateActCtx(void)
actctx.lpSource = source; /* source without hModule must point to valid PE */
SetLastError(0xdeadbeef);
handle = CreateActCtxA(&actctx);
todo_wine_if(i != 4)
ok(handle != INVALID_HANDLE_VALUE, "CreateActCtx error %lu\n", GetLastError());
ReleaseActCtx(handle);