Attachment 871418 Details for Bug 1067449 – Load: Fix again use of IPropertyBag + CComVariant

[patch] Load: Fix again use of IPropertyBag + CComVariant

0001-Load-Fix-again-use-of-IPropertyBag-CComVariant-10523.patch (text/plain), 2.94 KB, created by Uri Lublin on 2014-03-06 12:53:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Uri Lublin

Created: 2014-03-06 12:53:25 UTC

Size: 2.94 KB

patch

obsolete

>From 86ea15da62af83c6237c2b2b625edbbfcd6fc5ca Mon Sep 17 00:00:00 2001
>Message-Id: <86ea15da62af83c6237c2b2b625edbbfcd6fc5ca.1394034066.git.uril@redhat.com>
>From: Uri Lublin <uril@redhat.com>
>Date: Wed, 5 Mar 2014 17:28:23 +0200
>Subject: [PATCH] Load: Fix again use of IPropertyBag + CComVariant (#1052309)
>
>Also fixes #1067449
>
>IE11 still crashes when "Enhanced Protected Mode" is enabled.
>
>It seems to me there is a Windows bug with IPropertyBag->Read.
>When pVar (a CComVariant) type is set to VT_BSTR, and Read() fails
>(for example with E_INVALIDARG -- no such property name), then
>pVar value contains garbage, and IE segfaults when trying to free it.
>
>It turns out that if type is set to VT_EMPTY, if Read fails, type
>is kept as EMPTY, so no free problems.
>If Read succeeds it sets the type to whatever it thinks appropriate.
>
>This patch made the following changes:
>1. Use default constructor for pVar -- Initializes to VT_EMPTY.
>2. Call pVar.Clear() after every use -- to free memory and set
>   type back to VT_EMPTY.
>3. For string properties, call with VT_EMPTY type and check
>   the return value, the type and the length before accessing
>   the value.
>---
> OSpiceX.cpp |   23 +++++++++++------------
> 1 files changed, 11 insertions(+), 12 deletions(-)
> mode change 100644 => 100755 OSpiceX.cpp
>
>diff --git a/OSpiceX.cpp b/OSpiceX.cpp
>old mode 100644
>new mode 100755
>index 43a3d6a..9a8587a
>--- a/OSpiceX.cpp
>+++ b/OSpiceX.cpp
>@@ -379,7 +379,7 @@ STDMETHODIMP COSpiceX::SetSecondaryAddress(void)
> 
> STDMETHODIMP COSpiceX::Load(IPropertyBag *pPropBag, IErrorLog* pErrorLog)
> {
>-	CComVariant pVar(0);
>+	CComVariant pVar;
> 	HRESULT hRes;
> 
> 	pVar.vt = VT_UI2;
>@@ -388,40 +388,39 @@ STDMETHODIMP COSpiceX::Load(IPropertyBag *pPropBag, IErrorLog* pErrorLog)
> 	{
> 		m_Port = pVar.uiVal;
> 	}
>+	pVar.Clear();
> 
>-	pVar = 0;
> 	pVar.vt = VT_UI2;
> 	hRes = pPropBag->Read(L"SecurePort", &pVar, pErrorLog);
> 	if (hRes == S_OK)
> 	{
> 		m_SecurePort = pVar.uiVal;
> 	}
>+	pVar.Clear();
> 
>-	pVar = 0;
>-	pVar.vt = VT_BSTR;
>+	/* call Read with an Empty pVar */
> 	hRes = pPropBag->Read(L"HostIP", &pVar, pErrorLog);
>-	if (hRes == S_OK)
>+	if (hRes == S_OK && pVar.vt == VT_BSTR && lstrlen(V_BSTR(&pVar)) > 0)
> 	{
> 		StringCchCopyN(m_HostIP, MAX_PATH, pVar.bstrVal, MAX_PATH);
> 	}
>+	pVar.Clear();
> 
>-	pVar = 0;
>-	pVar.vt = VT_BSTR;
> 	hRes = pPropBag->Read(L"Title", &pVar, pErrorLog);
>-	if (hRes == S_OK)
>+	if (hRes == S_OK && pVar.vt == VT_BSTR && lstrlen(V_BSTR(&pVar)) > 0)
> 	{
> 		StringCchCopyN(m_Title, RED_CLIENT_MAX_TITLE_SIZE, pVar.bstrVal, RED_CLIENT_MAX_TITLE_SIZE);
> 	}
>+	pVar.Clear();
> 	
>-	pVar = 0;
>-	pVar.vt = VT_BSTR;
> 	hRes = pPropBag->Read(L"CipherSuite", &pVar, pErrorLog);
>-	if (hRes == S_OK && lstrlen(V_BSTR(&pVar)) > 0)
>+	if (hRes == S_OK && pVar.vt == VT_BSTR && lstrlen(V_BSTR(&pVar)) > 0)
> 	{
> 		m_bIsSSL = true;
>         StringCchCopyN(m_szCipherSuite, MAX_PATH, V_BSTR(&pVar), MAX_PATH);
> 	}
>-	
>+	pVar.Clear();
>+
> 	return S_OK;
> }
> 
>-- 
>1.7.1
>

Actions: View | Diff

Attachments on bug 1067449: 871418