Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-02-20 15:35:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

[BROWSEUI] Fix CAutoComplete use after free

Browse source 
CORE-18395
This commit is contained in:
Mark Jansen 2022-10-20 19:51:47 +02:00
parent 98b90e7394
commit a06f10d0c0
No known key found for this signature in database
GPG key ID: B39240EE84BEAE8B
2 changed files with 16 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
dll/win32/browseui/CAutoComplete.cpp
View file

@ -1,7 +1,7 @@
/*
* AutoComplete interfaces implementation.
*
* Copyright 2004 Maxime Bellengé <maxime.bellenge@laposte.net>
* Copyright 2004 Maxime Bellengé <maxime.bellenge@laposte.net>
* Copyright 2009 Andrew Hill
* Copyright 2020-2021 Katayama Hirofumi MZ <katayama.hirofumi.mz@gmail.com>
*
@ -1549,7 +1549,7 @@ LRESULT CAutoComplete::OnCreate(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL &b
m_hFont = reinterpret_cast<HFONT>(::GetStockObject(DEFAULT_GUI_FONT));
m_hwndList.SetFont(m_hFont);
// add reference to CAutoComplete::m_hWnd
// add reference so we won't be deleted during message processing
AddRef();
return 0; // success
}
@ -1575,11 +1575,19 @@ LRESULT CAutoComplete::OnNCDestroy(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL
// clean up
m_hwndCombo = NULL;
// remove reference to CAutoComplete::m_hWnd
Release();
// Tell ATL to clean up
bHandled = 0;
return 0;
}
VOID CAutoComplete::OnFinalMessage(HWND)
{
// The message loop is finished, now we can safely destruct!
Release();
}
// WM_EXITSIZEMOVE
// This message is sent once to a window after it has exited the moving or sizing mode.
LRESULT CAutoComplete::OnExitSizeMove(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL &bHandled)

6
dll/win32/browseui/CAutoComplete.h
View file

@ -1,7 +1,7 @@
/*
* AutoComplete interfaces implementation.
*
* Copyright 2004 Maxime Bellengé <maxime.bellenge@laposte.net>
* Copyright 2004 Maxime Bellengé <maxime.bellenge@laposte.net>
* Copyright 2009 Andrew Hill
* Copyright 2021 Katayama Hirofumi MZ <katayama.hirofumi.mz@gmail.com>
*
@ -156,9 +156,9 @@ public:
// public methods
CAutoComplete();
HWND CreateDropDown();
virtual ~CAutoComplete();
HWND CreateDropDown();
BOOL CanAutoSuggest() const;
BOOL CanAutoAppend() const;
BOOL UseTab() const;
@ -284,6 +284,8 @@ protected:
LRESULT OnAutoCompStart(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL &bHandled);
LRESULT OnAutoCompFinish(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL &bHandled);
virtual VOID OnFinalMessage(HWND) override;
DECLARE_REGISTRY_RESOURCEID(IDR_AUTOCOMPLETE)
DECLARE_NOT_AGGREGATABLE(CAutoComplete)
DECLARE_PROTECT_FINAL_CONSTRUCT()