From: Thomas Faber Subject: comctl32: Avoid use-after-free in DPA_Merge (DPH). Message-Id: <55323019.9050004@reactos.org> Date: Sat, 18 Apr 2015 12:21:13 +0200 DPA_InsertPtr and DPA_DeletePtr can call HeapReAlloc and change the location of the ptrs array. Thus the pWork pointers must be refreshed after such a call (or simply on every iteration). Fixes a crash when running comctl32_test with Windows's Debug Page Heap, which will relocate your heap block even if the size is unchanged. From 2b96765a44303dde9ecc81e4cb903c7db2075b9c Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Sat, 18 Apr 2015 12:08:29 +0200 Subject: comctl32: Avoid use-after-free in DPA_Merge (DPH). --- dlls/comctl32/dpa.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/dlls/comctl32/dpa.c b/dlls/comctl32/dpa.c index 148d3f1..b5b7ff8 100644 --- a/dlls/comctl32/dpa.c +++ b/dlls/comctl32/dpa.c @@ -303,16 +303,14 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags, hdpa1->nItemCount, hdpa2->nItemCount); - /* working but untrusted implementation */ - - pWork1 = &(hdpa1->ptrs[hdpa1->nItemCount - 1]); - pWork2 = &(hdpa2->ptrs[hdpa2->nItemCount - 1]); - nIndex = hdpa1->nItemCount - 1; nCount = hdpa2->nItemCount - 1; do { + pWork1 = &hdpa1->ptrs[nIndex]; + pWork2 = &hdpa2->ptrs[nCount]; + if (nIndex < 0) { if ((nCount >= 0) && (dwFlags & DPAM_UNION)) { /* Now insert the remaining new items into DPA 1 */ @@ -343,10 +341,8 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags, return FALSE; nCount--; - pWork2--; *pWork1 = ptr; nIndex--; - pWork1--; } else if (nResult > 0) { @@ -361,7 +357,6 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags, (pfnMerge)(DPAMM_DELETE, ptr, NULL, lParam); } nIndex--; - pWork1--; } else { @@ -377,7 +372,6 @@ BOOL WINAPI DPA_Merge (HDPA hdpa1, HDPA hdpa2, DWORD dwFlags, DPA_InsertPtr (hdpa1, nIndex+1, ptr); } nCount--; - pWork2--; } } -- 1.9.4.msysgit.2