system/wine
system/wine
1
0
Fork 0
mirror of git://source.winehq.org/git/wine.git synced 2024-07-20 05:04:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

server: Avoid using pointer value after realloc.

Browse source 
Signed-off-by: Rémi Bernon <rbernon@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Rémi Bernon 2022-05-22 18:53:54 +02:00 committed by Alexandre Julliard
parent 902a894900
commit c57eda2432
1 changed files with 8 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
server/queue.c
View file

@ -3348,15 +3348,14 @@ DECL_HANDLER(get_cursor_history)
DECL_HANDLER(get_rawinput_buffer) DECL_HANDLER(get_rawinput_buffer)
{ {
struct thread_input *input = current->queue->input; struct thread_input *input = current->queue->input;
data_size_t size = 0, next_size = 0; data_size_t size = 0, next_size = 0, pos = 0;
struct list *ptr; struct list *ptr;
char *buf, *cur, *tmp; char *buf, *tmp;
int count = 0, buf_size = 16 * sizeof(struct hardware_msg_data); int count = 0, buf_size = 16 * sizeof(struct hardware_msg_data);
if (!req->buffer_size) buf = NULL; if (!req->buffer_size) buf = NULL;
else if (!(buf = mem_alloc( buf_size ))) return; else if (!(buf = mem_alloc( buf_size ))) return;
cur = buf;
ptr = list_head( &input->msg_list ); ptr = list_head( &input->msg_list );
while (ptr) while (ptr)
{ {
@ -3369,31 +3368,31 @@ DECL_HANDLER(get_rawinput_buffer)
next_size = req->rawinput_size + extra_size; next_size = req->rawinput_size + extra_size;
if (size + next_size > req->buffer_size) break; if (size + next_size > req->buffer_size) break;
if (cur + data->size > buf + get_reply_max_size()) break; if (pos + data->size > get_reply_max_size()) break;
if (cur + data->size > buf + buf_size) if (pos + data->size > buf_size)
{ {
buf_size += buf_size / 2 + extra_size; buf_size += buf_size / 2 + extra_size;
if (!(tmp = realloc( buf, buf_size ))) if (!(tmp = realloc( buf, buf_size )))
{ {
free( buf );
set_error( STATUS_NO_MEMORY ); set_error( STATUS_NO_MEMORY );
return; return;
} }
cur = tmp + (cur - buf);
buf = tmp; buf = tmp;
} }
memcpy( cur, data, data->size ); memcpy( buf + pos, data, data->size );
list_remove( &msg->entry ); list_remove( &msg->entry );
free_message( msg ); free_message( msg );
size += next_size; size += next_size;
cur += sizeof(*data); pos += sizeof(*data);
count++; count++;
} }
reply->next_size = next_size; reply->next_size = next_size;
reply->count = count; reply->count = count;
set_reply_data_ptr( buf, cur - buf ); set_reply_data_ptr( buf, pos );
} }
DECL_HANDLER(update_rawinput_devices) DECL_HANDLER(update_rawinput_devices)