[Full-disclosure] Microsoft patches WMF... Wine is still exploitable?



---
wine-20050930/dlls/gdi/driver.c
---

/**************************************************************
Escape [GDI32.@]
*/
INT WINAPI Escape( HDC hdc, INT escape, INT in_count, LPCSTR in_data,
LPVOID out_data )
{
INT ret;
POINT *pt;

switch (escape)
{
case ABORTDOC:
return AbortDoc( hdc );
[ snip ]
case SETABORTPROC:
return SetAbortProc( hdc, (ABORTPROC)in_data );
[ snip ]

---
wine-20050930/dlls/gdi/printdrv.c
---

/**********************************************************
* call_abort_proc16
*/
static BOOL CALLBACK call_abort_proc16( HDC hdc, INT code )
{
ABORTPROC16 proc16;
DC *dc = DC_GetDCPtr( hdc );

if (!dc) return FALSE;
proc16 = dc->pAbortProc16;
GDI_ReleaseObj( hdc );
if (proc16)
{
WORD args[2];
DWORD ret;

args[1] = HDC_16(hdc);
args[0] = code;
WOWCallback16Ex( (DWORD)proc16, WCB16_PASCAL, sizeof(args), args,
&ret );
return LOWORD(ret);
}
return TRUE;
}


/******************************************************
* SetAbortProc (GDI32.@)
*
*/
INT WINAPI SetAbortProc(HDC hdc, ABORTPROC abrtprc)
{
DC *dc = DC_GetDCPtr( hdc );

if (!dc) return FALSE;
dc->pAbortProc = abrtprc;
GDI_ReleaseObj( hdc );
return TRUE;
}


---
wine-20050930/dlls/gdi/printdrv.c
---

/******************************************************************
* EndPage [GDI32.@]
*
*/
INT WINAPI EndPage(HDC hdc)
{
ABORTPROC abort_proc;
INT ret = 0;
DC *dc = DC_GetDCPtr( hdc );
if(!dc) return SP_ERROR;

if (dc->funcs->pEndPage) ret = dc->funcs->pEndPage( dc->physDev );
abort_proc = dc->pAbortProc;
GDI_ReleaseObj( hdc );
if (abort_proc && !abort_proc( hdc, 0 ))
{
EndDoc( hdc );
ret = 0;
}
return ret;
}

-HD
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: WM_ERASEBKGND problem
    ... RECT clientRect = Marshal.PtrToStructure ... IntPtr hRgnClip = IntPtr.Zero; ... ReleaseDC(this.Handle, hDC); ... public const int WM_NCCALCSIZE = 0x00000083; ...
    (microsoft.public.dotnet.framework.windowsforms)
  • Re: rotate EMF file With Gradient
    ... virtual int ProcessRecord(HDC hDC, HANDLETABLE *pHTable, ... dwError = GetLastError; ... static int CALLBACK EMFProc(HDC hDC, HANDLETABLE *pHTable, ... float fMmToPxlHorz = fHorzResolution/25.4f; ...
    (microsoft.public.win32.programmer.gdi)
  • Getting 1bpp with GDI
    ... I am struggling with converting a dotnet bitmap to 1bpp format with GDI. ... int xDpi = System.Convert.ToInt32 ... System.IntPtr hDc = CreateCompatibleDC; ... public static extern System.IntPtr GetObject (System.IntPtr hDc, ...
    (microsoft.public.win32.programmer.gdi)
  • Re: Searching simple waveform viewer
    ... HDC globalhdc; ... {int hCrt; ... void read_dat ... int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, ...
    (comp.arch.embedded)
  • Re: Getting 1bpp with GDI
    ... int xDpi = System.Convert.ToInt32 ... System.IntPtr hDc = CreateCompatibleDC; ... DeleteObject ); ... public static extern System.IntPtr CreateCompatibleDC ...
    (microsoft.public.win32.programmer.gdi)