From: Andrew Eikum <aeikum@codeweavers.com>
Subject: Re: [PATCH 1/2] msacm32: Add invalid parameter checks for acmFormatChoose().
Message-Id: <20170623161314.GS3954@foghorn.codeweavers.com>
Date: Fri, 23 Jun 2017 11:13:14 -0500
In-Reply-To: <20170622230241.3615-1-zfigura@codeweavers.com>
References: <20170622230241.3615-1-zfigura@codeweavers.com>

Signed-off-by: Andrew Eikum <aeikum@codeweavers.com>

On Thu, Jun 22, 2017 at 06:02:40PM -0500, Zebediah Figura wrote:
> From: Zebediah Figura <z.figura12@gmail.com>
> 
> Signed-off-by: Zebediah Figura <zfigura@codeweavers.com>
> ---
>  dlls/msacm32/format.c      |  9 +++++++++
>  dlls/msacm32/tests/msacm.c | 26 ++++++++++++++++++++++++++
>  2 files changed, 35 insertions(+)
> 
> diff --git a/dlls/msacm32/format.c b/dlls/msacm32/format.c
> index 19a5ceb8820..24d6ea5f60a 100644
> --- a/dlls/msacm32/format.c
> +++ b/dlls/msacm32/format.c
> @@ -288,6 +288,9 @@ MMRESULT WINAPI acmFormatChooseA(PACMFORMATCHOOSEA pafmtc)
>      LPWSTR              templ = NULL;
>      DWORD               sz;
>  
> +    if (pafmtc->cbStruct < sizeof(ACMFORMATCHOOSEA))
> +        return MMSYSERR_INVALPARAM;
> +
>      afcw.cbStruct  = sizeof(afcw);
>      afcw.fdwStyle  = pafmtc->fdwStyle;
>      afcw.hwndOwner = pafmtc->hwndOwner;
> @@ -359,6 +362,12 @@ done:
>   */
>  MMRESULT WINAPI acmFormatChooseW(PACMFORMATCHOOSEW pafmtc)
>  {
> +    if (pafmtc->cbStruct < sizeof(ACMFORMATCHOOSEW))
> +        return MMSYSERR_INVALPARAM;
> +
> +    if (!pafmtc->pwfx)
> +        return MMSYSERR_INVALPARAM;
> +
>      if (pafmtc->fdwStyle & ACMFORMATCHOOSE_STYLEF_ENABLETEMPLATEHANDLE)
>          return DialogBoxIndirectParamW(MSACM_hInstance32, (LPCDLGTEMPLATEW)pafmtc->hInstance,
>                                         pafmtc->hwndOwner, FormatChooseDlgProc, (LPARAM)pafmtc);
> diff --git a/dlls/msacm32/tests/msacm.c b/dlls/msacm32/tests/msacm.c
> index 19f5f0119a8..5b8b83ede3a 100644
> --- a/dlls/msacm32/tests/msacm.c
> +++ b/dlls/msacm32/tests/msacm.c
> @@ -1246,6 +1246,31 @@ static void test_acmFormatTagDetails(void)
>          ok(aftd.cbFormatSize == sizeof(MPEGLAYER3WAVEFORMAT), "got %d\n", aftd.cbFormatSize);
>  }
>  
> +static void test_acmFormatChoose(void)
> +{
> +    ACMFORMATCHOOSEW afc = {0};
> +    WAVEFORMATEX *pwfx;
> +    DWORD sizeMax;
> +    MMRESULT rc;
> +
> +    acmMetrics(NULL, ACM_METRIC_MAX_SIZE_FORMAT, &sizeMax);
> +    pwfx = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeMax);
> +
> +    afc.cbStruct = sizeof(afc);
> +    afc.pwfx = pwfx;
> +
> +    /* test invalid struct size */
> +    afc.cbStruct = sizeof(afc)-1;
> +    rc = acmFormatChooseW(&afc);
> +    ok(rc == MMSYSERR_INVALPARAM, "expected 0xb, got 0x%x\n", rc);
> +    afc.cbStruct = sizeof(afc);
> +
> +    afc.pwfx = NULL;
> +    rc = acmFormatChooseW(&afc);
> +    ok(rc == MMSYSERR_INVALPARAM, "expected 0xb, got 0x%x\n", rc);
> +    afc.pwfx = pwfx;
> +}
> +
>  static struct
>  {
>      struct
> @@ -1415,6 +1440,7 @@ START_TEST(msacm)
>      test_convert();
>      test_acmFormatSuggest();
>      test_acmFormatTagDetails();
> +    test_acmFormatChoose();
>      /* Test acmDriverAdd in the end as it may conflict
>       * with other tests due to codec lookup order */
>      test_acmDriverAdd();
> -- 
> 2.13.1
> 
> 
>