Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 871418 Details for
Bug 1067449
SPICE ActiveX crashes on IE 11
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
Load: Fix again use of IPropertyBag + CComVariant
0001-Load-Fix-again-use-of-IPropertyBag-CComVariant-10523.patch (text/plain), 2.94 KB, created by
Uri Lublin
on 2014-03-06 12:53:25 UTC
(
hide
)
Description:
Load: Fix again use of IPropertyBag + CComVariant
Filename:
MIME Type:
Creator:
Uri Lublin
Created:
2014-03-06 12:53:25 UTC
Size:
2.94 KB
patch
obsolete
>From 86ea15da62af83c6237c2b2b625edbbfcd6fc5ca Mon Sep 17 00:00:00 2001 >Message-Id: <86ea15da62af83c6237c2b2b625edbbfcd6fc5ca.1394034066.git.uril@redhat.com> >From: Uri Lublin <uril@redhat.com> >Date: Wed, 5 Mar 2014 17:28:23 +0200 >Subject: [PATCH] Load: Fix again use of IPropertyBag + CComVariant (#1052309) > >Also fixes #1067449 > >IE11 still crashes when "Enhanced Protected Mode" is enabled. > >It seems to me there is a Windows bug with IPropertyBag->Read. >When pVar (a CComVariant) type is set to VT_BSTR, and Read() fails >(for example with E_INVALIDARG -- no such property name), then >pVar value contains garbage, and IE segfaults when trying to free it. > >It turns out that if type is set to VT_EMPTY, if Read fails, type >is kept as EMPTY, so no free problems. >If Read succeeds it sets the type to whatever it thinks appropriate. > >This patch made the following changes: >1. Use default constructor for pVar -- Initializes to VT_EMPTY. >2. Call pVar.Clear() after every use -- to free memory and set > type back to VT_EMPTY. >3. For string properties, call with VT_EMPTY type and check > the return value, the type and the length before accessing > the value. >--- > OSpiceX.cpp | 23 +++++++++++------------ > 1 files changed, 11 insertions(+), 12 deletions(-) > mode change 100644 => 100755 OSpiceX.cpp > >diff --git a/OSpiceX.cpp b/OSpiceX.cpp >old mode 100644 >new mode 100755 >index 43a3d6a..9a8587a >--- a/OSpiceX.cpp >+++ b/OSpiceX.cpp >@@ -379,7 +379,7 @@ STDMETHODIMP COSpiceX::SetSecondaryAddress(void) > > STDMETHODIMP COSpiceX::Load(IPropertyBag *pPropBag, IErrorLog* pErrorLog) > { >- CComVariant pVar(0); >+ CComVariant pVar; > HRESULT hRes; > > pVar.vt = VT_UI2; >@@ -388,40 +388,39 @@ STDMETHODIMP COSpiceX::Load(IPropertyBag *pPropBag, IErrorLog* pErrorLog) > { > m_Port = pVar.uiVal; > } >+ pVar.Clear(); > >- pVar = 0; > pVar.vt = VT_UI2; > hRes = pPropBag->Read(L"SecurePort", &pVar, pErrorLog); > if (hRes == S_OK) > { > m_SecurePort = pVar.uiVal; > } >+ pVar.Clear(); > >- pVar = 0; >- pVar.vt = VT_BSTR; >+ /* call Read with an Empty pVar */ > hRes = pPropBag->Read(L"HostIP", &pVar, pErrorLog); >- if (hRes == S_OK) >+ if (hRes == S_OK && pVar.vt == VT_BSTR && lstrlen(V_BSTR(&pVar)) > 0) > { > StringCchCopyN(m_HostIP, MAX_PATH, pVar.bstrVal, MAX_PATH); > } >+ pVar.Clear(); > >- pVar = 0; >- pVar.vt = VT_BSTR; > hRes = pPropBag->Read(L"Title", &pVar, pErrorLog); >- if (hRes == S_OK) >+ if (hRes == S_OK && pVar.vt == VT_BSTR && lstrlen(V_BSTR(&pVar)) > 0) > { > StringCchCopyN(m_Title, RED_CLIENT_MAX_TITLE_SIZE, pVar.bstrVal, RED_CLIENT_MAX_TITLE_SIZE); > } >+ pVar.Clear(); > >- pVar = 0; >- pVar.vt = VT_BSTR; > hRes = pPropBag->Read(L"CipherSuite", &pVar, pErrorLog); >- if (hRes == S_OK && lstrlen(V_BSTR(&pVar)) > 0) >+ if (hRes == S_OK && pVar.vt == VT_BSTR && lstrlen(V_BSTR(&pVar)) > 0) > { > m_bIsSSL = true; > StringCchCopyN(m_szCipherSuite, MAX_PATH, V_BSTR(&pVar), MAX_PATH); > } >- >+ pVar.Clear(); >+ > return S_OK; > } > >-- >1.7.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 1067449
: 871418