Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 10:04:49 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTUSER] Scrollbar.c, Avoid potential out-of-bounds-accesses in co_IntSetScrollInfo() CORE-17777

Browse source 
This is an addendum to
0.4.15-dev-3174-g dda9c3979e CORE-17769 and
0.4.15-dev-3147-g 3bf7e3ac13 CORE-17754 CORE-17755

We have not seen this happening in real-life yet, but some code-fragments within co_IntSetScrollInfo()
e.g. line 628 if (nBar == SB_CTL) do clearly indicate that nBar can be 2 (SB_CTL).
Some lines below we definitely must not access those 4 static arrays out of bounds then via nBar as access index!

Ftr with a bit of grepping I also found some calls like NtUserSetScrollInfo(Wnd, SB_CTL, &Info, FALSE);
e.g: in win32ss/user/user32/controls/scrollbar.c so I am pretty sure nBar == 2 can happen in practice within co_IntSetScrollInfo().

I question whether any of those reads/writes to those static arrays (or the comparisons) would make any sense on index 2,
so we should aim to eliminate them altogether in the future.
This commit is contained in:
Joachim Henze 2021-09-20 03:05:05 +02:00
parent dda9c3979e
commit 222acf5a3e
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
win32ss/user/ntuser/scrollbar.c
View file

@ -492,15 +492,15 @@ co_IntSetScrollInfo(PWND Window, INT nBar, LPCSCROLLINFO lpsi, BOOL bRedraw)
BOOL bChangeParams = FALSE; /* Don't show/hide scrollbar if params don't change */
UINT MaxPage;
int MaxPos;
/* [0] = HORZ, [1] = VERT */
static PWND PrevHwnd[2] = { 0 };
static DWORD PrevPos[2] = { 0 };
static DWORD PrevMax[2] = { 0 };
static INT PrevAction[2] = { 0 };
/* [0] = SB_HORZ, [1] = SB_VERT, [2] = SB_CTL */
static PWND PrevHwnd[3] = { 0 };
static DWORD PrevPos[3] = { 0 };
static DWORD PrevMax[3] = { 0 };
static INT PrevAction[3] = { 0 };
ASSERT_REFS_CO(Window);
if(!SBID_IS_VALID(nBar))
if(!SBID_IS_VALID(nBar)) /* Assures nBar is 0, 1, or 2 */
{
EngSetLastError(ERROR_INVALID_PARAMETER);
ERR("Trying to set scrollinfo for unknown scrollbar type %d", nBar);