[ros-dev] [ros-diffs] [jgardou] 54179: [WinMM] - avoid buffer overrun. - do not try to unload uninitialized driver. See issue #6343 for more details.

Timo Kreuzer timo.kreuzer at web.de
Mon Oct 17 22:25:00 UTC 2011


I think that will not unload the last driver.
Looking at MMDRV_Install, MMDrvsHi is the index of the first free array 
field and its incremented each time MMDRV_Install is called. The assert 
in line 465 is wrong. It should be "<". The for () loop in line 432 is 
also wrong
Your change starts with MMDrvsHi - 1, the last used index, then 
decrements i by one before doing anything else.



Am 17.10.2011 18:35, schrieb jgardou at svn.reactos.org:
> Author: jgardou
> Date: Mon Oct 17 16:35:10 2011
> New Revision: 54179
>
> URL: http://svn.reactos.org/svn/reactos?rev=54179&view=rev
> Log:
> [WinMM]
> - avoid buffer overrun.
> - do not try to unload uninitialized driver.
> See issue #6343 for more details.
>
> Modified:
>      trunk/reactos/dll/win32/winmm/lolvldrv.c
>
> Modified: trunk/reactos/dll/win32/winmm/lolvldrv.c
> URL: http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/winmm/lolvldrv.c?rev=54179&r1=54178&r2=54179&view=diff
> ==============================================================================
> --- trunk/reactos/dll/win32/winmm/lolvldrv.c [iso-8859-1] (original)
> +++ trunk/reactos/dll/win32/winmm/lolvldrv.c [iso-8859-1] Mon Oct 17 16:35:10 2011
> @@ -634,7 +634,7 @@
>       }
>
>       /* unload driver, in reverse order of loading */
> -    i = sizeof(MMDrvs) / sizeof(MMDrvs[0]);
> +    i = MMDrvsHi - 1;
>       while (i-->  0)
>       {
>           MMDRV_ExitPerType(&MMDrvs[i], MMDRV_AUX);
>
>
>




More information about the Ros-dev mailing list