win32: add more clipboard data checks to avoid crash

It may happen that the received clipboard data is empty, but
if it's of type image/bmp, gtk+ will crash:

gdk_property_change: 00030AD4 GDK_SELECTION image/bmp REPLACE 8*0 bits:
... delayed rendering
gdk_selection_send_notify_for_display: 00030AD4 CLIPBOARD image/bmp
GDK_SELECTION (no-op)
_gdk_win32_selection_convert_to_dib: 1252003C image/bmp

Program received signal SIGSEGV, Segmentation fault.
0x749a9f40 in msvcrt!memmove () from C:\Windows\syswow64\msvcrt.dll

Thread 1 (Thread 2248.0x1b34):
target=0xc07b) at gdkselection-win32.c:1292
at gdkevents-win32.c:3498
wparam=8, lparam=0) at gdkevents-win32.c:232
message=773, wparam=8, lparam=0)
    at gdkevents-win32.c:263
C:\Windows\syswow64\user32.dll
C:\Users\rugoosse\AppData\Local\virt-viewer\bin\libpangocairo-1.0-0.dll
wparam=0, lparam=-1687549457)
    at gdkevents-win32.c:248
C:\Users\rugoosse\AppData\Local\virt-viewer\bin\libpangocairo-1.0-0.dll

https://bugzilla.gnome.org/show_bug.cgi?id=728745
This commit is contained in:
Marc-André Lureau 2014-04-22 19:47:47 +02:00
parent 37aa840e89
commit 2230fea0b6
2 changed files with 8 additions and 0 deletions

View File

@ -186,6 +186,12 @@ _gdk_win32_window_change_property (GdkWindow *window,
format == 8 &&
mode == GDK_PROP_MODE_REPLACE)
{
if (type == _image_bmp && nelements < sizeof (BITMAPFILEHEADER))
{
g_warning ("Clipboard contains invalid bitmap data");
return;
}
if (type == _utf8_string)
{
if (!OpenClipboard (GDK_WINDOW_HWND (window)))

View File

@ -1285,6 +1285,8 @@ _gdk_win32_selection_convert_to_dib (HGLOBAL hdata,
if (target == _image_bmp)
{
g_return_val_if_fail (GlobalSize (hdata) >= sizeof (BITMAPFILEHEADER), NULL);
/* No conversion is needed, just strip the BITMAPFILEHEADER */
HGLOBAL hdatanew;
SIZE_T size = GlobalSize (hdata) - sizeof (BITMAPFILEHEADER);