Skip to content

comctl32: Fix use-after-free when page creation fails.

Yuxuan Shui requested to merge yshui/wine:comctl32-page-fail-uaf into master

When page creation fails in PROPSHEET_SetCurSel, the dialog window is destroyed, which means the attached PropSheetInfo (psInfo) is freed. Because there is a call to PROPSHEET_SetCurSel in the handling of WM_INITDIAG, any use of psInfo thereafter could be invalid, which wasn't taken into account.


this feels a bit iffy but i think this is the right fix? previously we got 0 return value from PropertySheet because do_loop calls IsWindow(hwnd), and when page creation failed the hwnd is destroyed, which resulted in do_loop returning 0. i just duplicated this check in PROPSHEET_PropertySheet too. as for the change in DiaglogProc, if PROPSHEET_SetCurSel destroyed the window then the SendMessageW isn't necessary, i believe?

also, this bit is redundant i think?

      /* wizards set their focus during init */
      if (psInfo->ppshheader.dwFlags & INTRNL_ANY_WIZARD)
          return FALSE;

      return FALSE;

Merge request reports

Loading