https://bugs.documentfoundation.org/show_bug.cgi?id=173562
--- Comment #4 from Tim Schneider <[email protected]> --- Thats my proposed patch. From: Tim Schneider <[email protected]> Subject: [PATCH] tdf#173562 shell: don't PropVariantClear an uninitialized PROPVARIANT CPropertyHdl::LoadProperties declared a PROPVARIANT on the stack without initialising it and called PropVariantClear on it as the first statement of the loop. PropVariantClear dispatches on the .vt tag, so on the first iteration it interpreted stale stack bytes: if they looked like VT_BSTR, VT_LPWSTR or a vector type it freed a garbage pointer inside explorer.exe, which is the STATUS_HEAP_CORRUPTION (0xc0000374) crash users see when Explorer touches .ods/.odt files. The value loaded in the last iteration was also never released. Initialise the PROPVARIANT once with PropVariantInit and clear it at the end of every iteration instead, so every PropVariantClear sees a valid tag and nothing is leaked. --- shell/source/win32/shlxthandler/prophdl/propertyhdl.cxx | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/shell/source/win32/shlxthandler/prophdl/propertyhdl.cxx b/shell/source/win32/shlxthandler/prophdl/propertyhdl.cxx --- a/shell/source/win32/shlxthandler/prophdl/propertyhdl.cxx +++ b/shell/source/win32/shlxthandler/prophdl/propertyhdl.cxx @@ -275,11 +275,11 @@ HRESULT GetItemData( CMetaInfoReader *pMetaInfoReader, UINT nIndex, PROPVARIANT void CPropertyHdl::LoadProperties( CMetaInfoReader *pMetaInfoReader ) { OutputDebugStringFormatW( L"CPropertyHdl: LoadProperties\n" ); PROPVARIANT propvarValues; + PropVariantInit( &propvarValues ); for ( UINT i = 0; i < UINT(gPropertyTableSize); ++i ) { - PropVariantClear( &propvarValues ); HRESULT hr = GetItemData( pMetaInfoReader, i, &propvarValues); if (hr == S_OK) { @@ -290,6 +290,7 @@ void CPropertyHdl::LoadProperties( CMetaInfoReader *pMetaInfoReader ) // cache the value(s) loaded hr = m_pCache->SetValueAndState( g_rgPROPERTIES[i], &propvarValues, PSC_NORMAL ); } } + PropVariantClear( &propvarValues ); } } -- You are receiving this mail because: You are the assignee for the bug.
